The European Commission opened formal proceedings on Wednesday against Booking.com to establish whether the continent's largest accommodation-booking platform breached the Digital Services Act (DSA). The investigation is not about prices or competition: it is about fraud — and about how much the platform did to stop it.
"Europeans should be able to book their holidays without fear of being scammed," said European Commission Executive Vice-President Henna Virkkunen in announcing the case.
The three strands of the investigation
The Commission set out three suspicions:
- Fraudulent and non-compliant listings. Whether Booking.com diligently identified and addressed the risks tied to fake listings, to profiles impersonating real accommodation providers, and to offers that do not meet the platform's own rules.
- Phishing scams. Whether the company adequately assessed and mitigated the risk of scams that exploit its reservation and guest data — including how that data is shared with hosts and what safeguards exist against misuse.
- Unlabelled advertising. Whether accommodation listings whose providers pay for higher placement in search results are clearly marked as advertising, as the DSA's transparency chapter requires. In the Commission's words, users should be able to recognise that these boosted listings "are in fact advertisements".
Why Booking.com carries these obligations
The DSA imposes on very large online platforms a duty that did not exist before: to assess periodically the systemic risks the service itself creates, and to adopt effective measures to reduce them. Taking down a fake listing after a complaint is not enough; the platform has to show it mapped the risk and acted on it.
Scale is what puts Booking.com in that category. According to the Commission, 66% of online accommodation bookings in Europe go through the platform, which offers more than 30 million accommodation options and has handled some 6.5 billion bookings since 2010.
The company's response
Booking.com said it is "cooperating fully" with the Commission and has been engaging constructively with its questions on the DSA. "Safety, trust, and the protection of personal data are the highest priority at Booking.com," the company said, adding that it works with regulators and law enforcement against cybercrime and fraud.
What comes next
Opening formal proceedings does not prejudge the outcome. From here, the Commission can gather further evidence, adopt interim measures, accept commitments offered by the company or, eventually, issue a non-compliance decision. There is no fixed statutory deadline for closing this kind of case.
For a reader booking accommodation in Europe, the investigation has one practical effect regardless of how it ends: it puts on the record, in an official document, that the bloc's regulator considers it plausible that paid listings appear there without being marked as ads.
With information from the European Commission, NL Times and The Irish Times.
