The News, Explained
On October 21, 2026, the European Commission opened formal proceedings into possible Digital Services Act (DSA) breaches by Booking.com. Its focus is fraudulent or noncompliant listings, reservation-data phishing and advertising labels for paid visibility. Opening proceedings does not establish a final breach. Source Source
The inquiry asks whether risks such as nonexistent properties and impersonation were adequately addressed. It also examines safeguards around reservation and guest data shared with properties, and the platform’s messaging service. The announcement cannot authenticate an individual booking or message. Source
Properties can pay higher commissions for greater search visibility. Investigators will examine whether users can recognize these placements as ads and identify the advertiser and payer. A prominent result therefore needs to be distinguished from the best match for a trip; this does not mean every high-ranking property is an advertisement. Source
Phishing impersonates a trusted party to obtain information or money. Booking.com’s traveler guidance says messages posing as a property or the company may contain accurate stay dates and prices, with urgent requests to resubmit payment information to retain a booking. Knowing a reservation’s details alone is therefore insufficient evidence of a sender’s legitimacy. Source
Booking.com says it does not request card details by email, phone, text or WhatsApp, or bank transfers outside the confirmation’s payment policy. Its guidance is to compare the confirmation and contact official customer service before acting if doubtful. This offers a way to distinguish stated prepayment terms from an unexpected change in payment demands. Source
OYOPICK’s Take
Search convenience can strengthen choice when people understand why a result appears prominently. If travelers can compare an ad label alongside price, location and cancellation terms, they could assess paid placements without automatically excluding them. We would look for whether people can understand and use a label, alongside whether one is displayed.
Messaging raises a different design question: remembering a booking’s details is insufficient protection when an impersonator knows them too. We hope platforms make differences between confirmed payment terms and later requests easier to recognize. The investigation’s outcome remains open. Safer connections could let travelers devote less effort to detecting manipulation and more to the trip itself.