European Commission launches investigation into Booking.com over DSA compliance

On October 21, 2026, the European Commission initiated a formal investigation into Booking.com to determine its compliance with the Digital Services Act (DSA). The decision follows a preliminary assessment and a review of risk mitigation reports submitted by the company. The investigation focuses on three primary systemic risks: the presence of fraudulent or non-compliant accommodation listings, including non-existent properties; the prevalence of phishing attacks that exploit guest and booking data; and a lack of transparency regarding advertisements.

Regulators are specifically examining whether the platform has effectively identified and mitigated risks related to illegal content and deceptive practices that mislead consumers. Additionally, the Commission is scrutinizing whether Booking.com clearly labels listings that receive higher rankings due to paid commissions, which would constitute a failure in transparency obligations under EU regulations. The probe aims to ensure that the platform establishes robust measures to remove fraudulent offers and protect user data from cyber security threats. The investigation process will involve further cooperation with the company to determine if systemic failures have occurred in the platform's oversight mechanisms.