The European Commission has opened formal proceedings into Booking.com under the Digital Services Act (DSA) to assess whether the online travel platform is adequately protecting consumers from fraudulent listings, phishing scams, and misleading advertising practices. The investigation is being conducted in close coordination with the Netherlands Authority for Consumers & Markets (ACM), given that Booking.com’s European headquarters are located in the Netherlands.

Regulatory scrutiny comes amid a sharp rise in cybercrime and consumer reports across online accommodation platforms. Travelers have increasingly fallen victim to elaborate scams, including bookings for non-existent properties, impersonation schemes, and phishing attacks where bad actors hijack host accounts to request unauthorized payments directly from guests.

Under the DSA, platforms designated as Very Large Online Platforms (VLOPs)—such as Booking.com—are legally bound to identify, assess, and mitigate systemic risks on their networks. The Commission’s inquiry focuses on three main areas: whether Booking.com exercises sufficient diligence to detect and remove fraudulent property offers, whether it maintains adequate security measures to prevent reservation and guest data from being exploited in phishing schemes, and whether it complies with mandatory advertising transparency rules.

Regarding transparency, regulators are examining whether paid listings—where property owners pay higher commissions to gain boosted visibility in search results—are clearly labeled as sponsored advertisements so consumers can make fully informed choices.

The ACM is assisting the Commission by gathering evidence locally, though supervision of VLOPs is led directly by Brussels. If the investigation establishes non-compliance, Booking.com could face significant binding commitments or regulatory fines under the EU’s enforcement framework.