EU Opens Formal Probe of Booking.com Over Fake Listings and Paid Top Spots

The European Commission has opened a formal investigation into Booking.com's handling of scams and paid search rankings, putting the accommodation platform's safeguards and advertising transparency under scrutiny. ^[1]

The proceedings, opened on October 21, 2026, will examine possible breaches of the Digital Services Act, the European Union's law governing online platforms. The Commission is investigating risks from fraudulent accommodation listings, phishing scams exploiting reservation and guest data, and listings whose providers paid for higher positions in search results. ^[1]

For travellers, those questions reach three basic parts of booking a stay: whether the accommodation is real, whether a message about a reservation is genuine, and whether a prominent search result is an advertisement. The investigation concerns the systems behind those encounters, including how Booking.com assessed risks and what it did to reduce them. ^[1]

The opening of proceedings is not a finding that Booking.com broke the law. Any final non-compliance decision would follow further investigation and an opportunity for the company to answer the Commission's preliminary findings. ^[1][4]

Three tests of trust

On fraud, the Commission will assess whether Booking.com diligently identified and assessed the risks posed by fraudulent listings, and whether its measures to address them were effective. The inquiry therefore reaches beyond whether a particular listing should have been removed. It examines the platform's approach to a category of risk. ^[1]

The phishing strand concerns scams that exploit reservation and guest data. Phishing involves messages designed to trick recipients into treating a fraudulent request as genuine. Here, the Commission is examining whether Booking.com adequately assessed and mitigated the risks associated with that abuse. ^[1]

The Commission's announcement does not identify the specific incidents or evidence that prompted the proceedings. Booking.com's response to the new investigation was not available. ^[1]

The advertising inquiry addresses a different part of the service: the order in which accommodation appears. The Commission will examine whether listings whose providers paid for higher search rankings were clearly identifiable as advertisements. The DSA requires clear advertising labels. ^[1][2]

Paying for prominence is not itself the alleged breach. The question is whether users could recognise the commercial placement. A traveller needs that information to judge a result's position, rather than having to infer why one property appears above another.

Why Booking.com's size matters

Booking.com is designated a very large online platform under the DSA. The Commission's supervision register lists it as having more than 45 million average monthly active users and its main EU establishment in the Netherlands. ^[5]

That designation brings additional obligations. Very large platforms must assess and mitigate systemic risks, including those related to illegal content and consumer protection, alongside transparency requirements. The DSA also covers online travel and accommodation platforms, so these duties extend to services used to book a room, not just social networks or search engines. ^[2][3]

The scale of the service makes the quality of its safeguards a regulatory concern in its own right. The Commission's stated test is whether the company assessed risks diligently and reduced them effectively, rather than simply whether it had some protective measures in place. ^[1][3]

The formal case follows earlier scrutiny. The Commission's register records requests for information to Booking.com in January 2024 and September 2025, before the proceedings opened this month. Those entries establish that the regulator had already sought information from the company. ^[5]

What Brussels can demand

The Commission can now gather evidence through several routes. It can request information, interview people with relevant knowledge if they consent, inspect premises, and seek access to platform data and algorithms. Those powers allow it to examine how a service works as well as what the company says about it, including the machinery behind search results. ^[4]

The enforcement framework also allows temporary, proportionate interim measures during an investigation if the Commission considers them urgent to prevent a risk of serious harm to users. Such action is a separate tool from a final finding of non-compliance. ^[4]

If the Commission ultimately establishes a breach, it can order remedies and impose a proportionate fine of up to six percent of the provider's global annual turnover. That is a legal ceiling, not an announced penalty or an estimate of what this case might cost. ^[4]

Before reaching a final non-compliance decision, the Commission must give Booking.com the opportunity to respond to its preliminary findings. ^[4]