On 21 October 2026 the European Commission opened formal proceedings against Booking.com under the Digital Services Act (DSA), press release IP/26/2223. Booking.com was designated a Very Large Online Platform on 25 April 2023. The Commission says the platform may have breached the DSA in three areas.

What the Commission is investigating

  1. Fraudulent and non-compliant listings. Whether Booking.com properly identified and assessed the systemic risk of illegal content, such as listings for non-existent properties, impersonation fraud and non-compliant accommodation, and whether it has effective measures to reduce it, including removing such listings.
  2. Phishing using reservation and guest data. Whether it assessed and addressed the risk that the way reservation and guest data is shared with accommodation providers, and the design of its messaging service, lets scammers phish guests and request fraudulent payments.
  3. Paid “boosted” listings. Hosts can make listings more visible by paying a higher commission. The Commission will examine whether users can tell these are ads, and whether for each ad they can see who is behind it, who paid, why they are seeing it, and how to change their ad settings.
Without clear labelling, users “cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility.” — European Commission, IP/26/2223

The legal hooks

If proven, the Commission says the failures would infringe Articles 34 and 35 of the DSA (very large platforms must identify, assess and mitigate systemic risks) and Article 26(1) (users must be able to clearly identify ads and who is behind them). Under the DSA, a non-compliance decision can carry fines of up to 6% of a provider’s worldwide annual turnover.

How it got here, and what comes next

The Commission says the decision follows a preliminary investigation. That covered Booking.com’s risk-assessment reports for 2026 and the three years before, its transparency reports, and its answers to formal requests for information sent on 23 September 2025 and 26 May 2026. It works with the Netherlands Authority for Consumers and Markets (ACM), the Digital Services Coordinator where Booking.com is established.

Next, the Commission can send more requests for information, interview people and carry out inspections. Opening proceedings also lets it impose interim measures, adopt a non-compliance decision, or accept binding commitments from Booking.com. The Commission stresses that opening proceedings “does not prejudge any final outcome.” There is no legal deadline for a decision.

Citizen impact: Travellers from anywhere who book a European stay through Booking.com, including Canadians and Americans, are the people exposed to fake listings and payment-request scams. Hosts who pay a higher commission for visibility could be required to have those placements labelled as ads, which changes what a “top result” means to a guest. This is consumer-fraud and ad-transparency enforcement. It is not a content-moderation case about speech.

What this piece refuses

Do not write that the EU “found” Booking.com guilty or “fined” it. These are formal proceedings, and no decision has been taken. We did not use unnamed-official quotes in some reports describing Booking.com’s efforts as “absolutely substandard”, because the Commission’s release does not say that. We have not reported any fine amount, because none exists.

Bottom line

Verified from the Commission’s IP/26/2223 (21 October 2026): formal DSA proceedings are open against Booking.com on fraudulent listings, phishing through shared guest data and unlabelled paid rankings (Arts. 34, 35 and 26(1)). Next steps: more evidence-gathering, with possible interim measures, commitments or a non-compliance decision.