Summary

  • On 21 October 2026 the European Commission opened formal DSA proceedings concerning Booking.com’s listing controls, phishing risks around reservation data and messaging, and the identification of paid search placements.
  • The opening puts the covered Article 26 advertising conduct under Commission enforcement. The Dutch Digital Services Coordinator remains a cooperation partner; the next decisive evidence concerns what the platform showed users and what its own risk records and safeguards show.

Three doors into the same booking

A hotel search result can promise a room, start a conversation and sell its position on the page. Those are three separate acts. The European Commission has put all three into its 21 October Booking.com proceeding. The file concerns allegedly fraudulent or non-compliant accommodation listings, phishing using reservation and guest data, and boosted listings whose paid status may be obscure to the reader.

There is a useful absurdity in the layout. The top result can look like the best match when it is a bought position; the message following a reservation can look like service when it asks for a payment it should never receive; the accommodation photograph can describe a place that the investigator must verify exists. A person booking a room sees one seamless journey. The regulator sees separate control systems with different records, duties and failure modes.

The Commission’s fuller original release names the questions more precisely. On listings, it will examine how Booking.com identified and assessed systemic risk from unlawful offers, including nonexistent properties and impersonation, and whether it put effective removals and other mitigation in place. On phishing, it will examine how reservation and guest information reaches accommodation providers, how the messaging service works, and whether safeguards keep that information from becoming a convincing request for a fraudulent payment. On rankings, it will test whether a user can recognize a promoted placement as an ad and see the sponsor, payer, reason for display and relevant settings.

Those questions share a commercial interface, but they require different proof. A takedown count cannot reveal whether fake inventory was identified quickly. A message warning cannot establish whether guest data was shared safely. An attractive search label cannot settle whether the paid nature of a higher commission was obvious when the result appeared. The Commission has opened the file; it has not published a breach decision. Its stated scope is already concrete enough to show where the evidence will come from.

The commission under the top result

Accommodation providers can buy more prominent placement by paying Booking.com a higher commission, according to the Commission release. Paid ranking is a sale of visibility. The DSA question is whether the resulting display tells the person searching that visibility was purchased. Article 26(1) requires an online platform to make advertisements recognizable and to provide information about who presents and pays for them and the main parameters behind their display.

This is where platform language can do quiet work. A label that says “popular” speaks about other travellers; a label that says “promoted” speaks about the commercial arrangement. The law is concerned with what the user can discern at the moment of choice, not with how elegantly the platform explains its sales programme elsewhere. The Commission says it will examine whether each ad presents the necessary information and whether the user can alter settings that shape the ads shown.

The same search page is also the entrance to the listing-risk question. Under DSA Articles 34 and 35, very large platforms must assess systemic risks and apply mitigation fitted to them. The issue is a chain of controls: how an accommodation offer enters the system, which signals bring it under scrutiny, how a suspicious offer is removed, and how the platform measures whether its choices actually reduce harm. The Commission’s description makes no room for a single decorative “trust” badge to answer all four.

The message after the reservation

A phishing message is powerful precisely because it arrives after the transaction feels real. The Commission is investigating the junction between Booking.com’s reservation records, its information sharing with accommodation providers and its messaging design. Its published question is whether safeguards prevent those ingredients from being misused to solicit fraudulent payments. That is a control question about access, design and intervention, not a claim that every provider account or guest record was compromised.

The preliminary file already has a paper trail. The Commission says it examined Booking.com risk assessments from 2026 and the three preceding years, published transparency material and replies to its information requests of 23 September 2025 and 26 May 2026. Those documents may reveal whether the platform’s stated risks were followed by specific controls and whether the controls were tested against the way fraudsters exploit a legitimate booking. The underlying reports are not reproduced in the opening announcement; the next public finding will matter more than a confident guess at their contents.

Brussels holds the DSA pen

The Commission’s register of very large platforms records Booking.com’s designation on 25 April 2023 and identifies the Netherlands as its Digital Services Coordinator jurisdiction. The new formal proceeding changes the allocation of DSA enforcement authority for the conduct it covers. Article 66 requires coordinators to pass relevant information to the Commission and relieves them of their DSA supervision and enforcement powers for that conduct once the Commission opens proceedings. The Commission’s Booking.com release applies that handoff expressly to the suspected Article 26(1) advertising issue. It also says it is cooperating with the Dutch Authority for Consumers and Markets.

The Dutch authority may still help gather evidence. The Commission holds the decision in this DSA file. That distinction matters more than the number of bodies named on a press page. If a Dutch investigator inspects a local record at Brussels’ request, the power to choose the case outcome has not drifted back across the border. The rule places one hand on the enforcement pen while letting other hands supply evidence.

For now the Commission can request more information, interview people, inspect records, consider interim measures or accept commitments. It has announced a formal investigation and three questions. Its eventual decision, any binding commitments and the supporting account of the platform’s controls will tell readers how those questions were answered. Until then, the most revealing object may be a plain search card: a room, a position in the ranking and the label that explains who paid to put it there.

Original sources