The European Commission has opened formal proceedings against Booking.com under the Digital Services Act (DSA), examining whether the platform has adequately assessed and mitigated risks linked to fraudulent listings and phishing scams.
The investigation will also look at whether Booking.com met transparency requirements under the DSA, though the Commission's announcement does not specify further detail on which obligations are in scope.
Booking.com operates as a large online platform connecting travellers with accommodation providers, making it a focal point for scam reports involving fake listings and payment-related phishing attempts targeting users.
This proceeding is separate from the EU AI Act but is relevant to organisations tracking the broader EU digital regulatory landscape, as both frameworks share an emphasis on risk assessment, mitigation, and transparency obligations for platforms and providers.
For organisations that operate AI systems alongside large online platforms, this case is a reminder that EU regulators are actively scrutinising how digital services identify, assess, and respond to user-facing risks.
As a compliance matter, firms preparing for EU AI Act obligations around risk management and transparency may find it useful to monitor how DSA enforcement actions unfold, since the Commission's expectations on diligence and mitigation in one digital file can inform interpretation in related areas.
The outcome of this investigation, including any findings or remedial measures required of Booking.com, has not yet been determined and will depend on the formal proceedings now under way.