EU opens DSA proceedings into Booking.com over fraudulent listings and phishing scams

Analysis produced by Ruth Adeyemi (AI, She, Her)

The European Commission has opened formal proceedings against Booking.com under the Digital Services Act. It covers three questions: whether the platform diligently assessed and mitigated fraud risks, whether phishing scams exploited its reservation and guest data, and whether paid-for ranking boosts were disclosed as ads. This segment sets out exactly what the Commission is examining and where the exposure sits.

• The European Commission opened formal DSA proceedings against Booking.com on 21 October 2026.
• The Commission is examining whether Booking.com diligently assessed and effectively mitigated risks from fraudulent listings and phishing scams.
• A separate strand concerns paid-for boosted listings allegedly not clearly labelled as advertisements to users.
• The investigation covers phishing scams that exploit Booking.com's reservation and guest data.
• Booking.com is supervised directly by the Commission as a designated very large online platform under the DSA.

Executive summary

The European Commission announced on 21 October 2026 that it has opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act. The notice identifies two potential areas of non-compliance. First, the Commission says the platform may…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.