Booking.com Investigation: What the EU Probe Means for Hosts
The EU opened a Booking.com investigation over fake listings, phishing and boosted listings. Here’s what the DSA probe could change for hosts.
Source
[RSU by PriceLabs](/resources/people/rsu-by-pricelabs): Booking.com Investigation: What the EU Probe Means for Hosts
What It Says
On October 21, 2026, the European Commission launched its first Digital Services Act (DSA) investigation into Booking.com. The probe focuses on three primary areas:
- Fraudulent and Non-Compliant Listings: Evaluating how effectively the platform identifies, prevents, and removes fake listings, impersonation scams, and properties violating local regulations.
- Phishing and Guest Data Security: Investigating whether Booking.com's messaging system and data-sharing practices with hosts leave vulnerabilities that scammers exploit to solicit fraudulent payments.
- Boosted Listings Transparency: Assessing whether listings that receive search ranking boosts in exchange for higher commission rates (such as Preferred and Preferred Plus programs) are clearly labeled as advertisements.
Booking.com, designated as a "Very Large Online Platform" under the DSA and a "gatekeeper" under the Digital Markets Act (DMA), has stated it is cooperating fully with the European Commission.
Why It Matters
As Europe's largest accommodation platform, Booking.com is the regulatory test case for online travel agency (OTA) safety and transparency. The outcome of this investigation will set a precedent for how all major booking platforms operate.
For short-term rental (STR) operators, the investigation targets the core mechanics of how they communicate with guests, collect payments, and market their properties. If the EU mandates stricter controls, it could fundamentally alter the guest-host relationship, restrict access to guest contact information, and impact the ROI of paid visibility programs.
Useful Signals
- Payment and Messaging Vulnerabilities: Unlike Airbnb, Booking.com allows flexible payment options, including paying the host directly via external links. Scammers exploit this by using compromised host accounts or intercepted booking data to send highly convincing phishing links to guests.
- The "Ad" Label Risk: If the EU rules that commission-based visibility boosts constitute paid advertising, Booking.com may be forced to label these listings as "ads." This could negatively impact guest click-through and conversion rates for hosts relying on Preferred or Preferred Plus programs.
- Data Minimization Trend: Platforms are increasingly restricting host access to direct guest data (e.g., Airbnb's removal of email aliases and transition to temporary phone numbers) to prevent off-platform phishing. Booking.com may be forced to adopt similar restrictive measures.
STR Tech Report Take
This investigation highlights the growing tension between platform security and host autonomy. For STR technology vendors—especially Property Management Systems (PMS) and guest communication tools—any forced changes to Booking.com’s messaging API or guest data access will require rapid software adaptations.
Operators must prepare for a future with "less data and more friction." To mitigate these risks, managers should strengthen their own cybersecurity hygiene, implement multi-factor authentication on all OTA accounts, and establish clear, off-platform brand identities to secure direct bookings and independent guest relationships.
Original Source
RSU by PriceLabs: Booking.com Investigation: What the EU Probe Means for Hosts
Get more insights like this
Weekly STR tech updates. No spam.