The European Commission opened a Digital Services Act investigation into Booking.com on Oct. 21, putting its protections against booking fraud and its commission-boosted search results under scrutiny for travelers.
Accommodation providers can pay Booking.com higher commissions for greater visibility in its results. Regulators will examine whether travelers can identify those placements as advertisements and see who paid for them. The arrangement gives providers a way to gain prominence while raising a question about what travelers understand when they compare properties.
The investigation also covers listings for properties that may not exist, offers involving impersonation and accommodations that may not comply with rules. The Commission will assess how Booking.com evaluates those risks and whether it effectively removes fraudulent and non-compliant listings.
Phishing is another focus. Investigators will examine how reservation and guest information is shared with accommodation providers, how Booking.com's messaging service operates and what safeguards protect users from fraudulent payment requests. The Commission has not attributed any particular scam to a specific cause.
Before opening proceedings, the Commission reviewed Booking.com's risk assessments from 2026 and the preceding three years, along with transparency reports and replies to information requests sent on Sept. 23, 2025, and May 26, 2026. Booking.com came under the Commission's supervision for relevant Digital Services Act obligations after its designation as a very large online platform in 2023.
EU concerns about how Booking.com presents search results predate this case. In a separate consumer-protection process, the company committed in 2019 to explain when payments influenced accommodation rankings. A Commission factsheet said in 2020 that Booking.com had added disclosures. The current inquiry concerns its practices under the Digital Services Act.
Reuters reported that Booking.com described its engagement with the Commission as constructive. The company described security, trust and protection of personal information as priorities.
Opening proceedings does not establish a violation. If the Commission finds a breach, a fine could reach 6% of the provider's global annual turnover. Investigators will seek more evidence, and the Commission has announced no decision timetable.
