The Commission has not decided that Booking.com broke the law. It has decided to check.
Fact
The facts: on 21 October 2026 the European Commission announced it has opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act (DSA). According to the Commission, the platform may not have diligently assessed or effectively mitigated the risks related to fraudulent listings and phishing scams. It may also have breached transparency rules by not clearly labelling as ads those listings whose providers paid for a higher ranking in search results. The proceedings have three areas: fraudulent and non-compliant listings; phishing scams exploiting Booking.com's reservation and guest data; paid boosted listings not clearly identifiable as advertisements. The page was updated on 22 October.
The first two areas are about fraud that passes through the platform: fake listings and phishing built on knowledge of reservations and guests. The third is about the platform itself. Listings that paid for a higher place in search, with nothing to show they are ads.
Proceedings are a question. The decision comes later.
Of the three, phishing is the one closest to you. The Commission will look at how reservation and guest data is shared with accommodation providers, how Booking.com's messaging service works, and whether there are enough safeguards to stop the data being misused for phishing and to solicit fraudulent payments.
If a message about your reservation comes with a link, don't open it. You go to the site or the app yourself and check the booking there.
Sources
European Commission - Commission to investigate how Booking.com combats scams and fraud under the Digital Services Act, 21.10.2026European Commission - press release IP/26/2223, Commission to investigate how Booking.com combats scams and fraud under the Digital Services Act, 21.10.2026The visual is generated code-art, no third-party images.