Commission opens investigation into how Booking.com tackles scams and fraud under the Digital Services Act

The European Commission has opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act (DSA) by failing to diligently assess or effectively mitigate the risks linked to fraudulent listings and phishing scams. The platform may also have breached the DSA's transparency rules by not clearly labelling as ads those listings whose providers paid for a better position in search results. The investigation will focus on three areas. 1. Fraudulent and non-compliant listings. The Commission will examine whether Booking.com properly identified and assessed systemic risks linked to the spread of illegal content. Fake listings -- for non-existent properties, impersonation fraud and non-compliant accommodation offers -- can harm consumer protection. It will also assess whether the platform put effective measures in place to mitigate these risks, including removing fraudulent and non-compliant listings. 2. Phishing scams exploiting Booking.com booking and guest data. The Commission will investigate whether Booking.com carefully assessed and addressed the risks phishing scams pose to consumers, looking in particular at how booking and guest data are shared with accommodation providers and at the design and operation of Booking.com's messaging service. It will also check whether the company has sufficient safeguards to prevent data being misused for phishing and to request fraudulent payments. 3. Paid, boosted listings that cannot be clearly identified as ads. Accommodation providers can make their listings more visible in search results by paying a higher commission. Users should be able to clearly recognise that these "boosted listings" are in fact advertisements, and to easily see who is behind each ad, who paid for it, why they see it and how to change the settings that determine which ads they see. If proven, these shortcomings would breach Articles 34 and 35 of the DSA (identifying, assessing and mitigating systemic risks on very large platforms and search engines) and Article 26(1) (ensuring users can clearly identify ads). Next steps The Commission will carry out an in-depth investigation as a matter of priority, continuing to gather evidence through further information requests, interviews or inspections. Opening formal proceedings also allows it to take further enforcement steps, such as interim measures and non-compliance decisions, and to accept commitments offered by Booking.com. Opening proceedings does not prejudge the outcome. Background The decision follows a preliminary investigation, including analysis of Booking.com's 2026 and previous risk assessment reports, its transparency reports and its replies to formal information requests sent on 23 September 2025 and 26 May 2026. The Commission is cooperating with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator in the Member State where Booking.com is established. Booking.com was designated a very large online platform under the DSA on 25 April 2023.