The European Union began an investigation into the online travel agency Booking.com on Wednesday. The reason cited is alleged shortcomings in combating fake listings and phishing schemes.
The EU is concerned that Booking.com underestimated the impact of fraud and unlicensed listings, and that it does not adequately protect user data from misuse for fraudulent purposes.
This investigation is the first against Booking.com under the Digital Services Act (DSA)—a comprehensive piece of internet content legislation that covers a wide range of platforms, including social networks and digital marketplaces.
Henna Virkkunen, the EU's lead specialist on technology, stated in her announcement that 'Europeans should be able to book their holidays without fear of falling victim to scammers.'
Furthermore, the EU is examining whether the company, based in the Netherlands, violated rules because it 'did not label as advertising those listings whose suppliers paid for a higher ranking in the search results displayed to users.'
Virkkunen added that the DSA 'establishes clear obligations' and 'we must ensure that the leading booking platform in Europe takes these obligations seriously.'
Booking.com reported that it 'fully cooperates' and that 'safety, trust, and personal data protection are top priorities.'
The company also emphasized its commitment to working with relevant governments, regulators, law enforcement agencies, and industry partners to combat cybercrime and online fraud, as well as to protect travelers and partners.
Booking.com is among more than 20 very large online platforms that are required to comply with stricter DSA rules, otherwise they risk fines of up to six percent of global turnover or even a ban for serious and repeated violations.
There is no set deadline for the investigation, but the target company can provide guarantees to alleviate the concerns of the European Commission.
Suspicions Regarding Data
A high-ranking EU official criticized Booking.com's risk assessment efforts since 2023. This official, who wished to remain anonymous, stated that 'we believe what they have done is completely inadequate.'
EU digital supervision will assess whether the online platform has 'duly identified' the risks associated with the spread of illegal content, such as non-existent properties or fraudsters posing as property owners and renting them out.
In some cases, customers discover upon arrival that the booked property does not exist, and most often, the photos or descriptions of the properties do not match reality.
The EU will also check whether Booking.com has taken sufficient measures to mitigate the risks posed by phishing schemes to European consumers. Phishing is defined as the practice of deceiving people to obtain confidential information through misleading messages.
The EU will examine how booking and guest data is transferred to accommodation providers and whether Booking.com has provided 'sufficient safeguards to prevent the misuse of data.'
The high-ranking official noted: 'We suspect that Booking does not adequately protect the data of private and business users, which makes the system vulnerable to this type of phishing.'