On 21 October 2026 the European Commission opened formal proceedings against Booking.com under the Digital Services Act (DSA). The Amsterdam-based company is under its first formal DSA investigation. The Commission is asking whether Booking.com diligently assessed and mitigated the risks from fraudulent and non-compliant listings, whether phishing scams exploit the reservation and guest data it shares with hosts, and whether paid, boosted listings are clearly identifiable as advertising.
Coverage of the Commission's announcement says it is working with the Dutch regulator, the Authority for Consumers and Markets (ACM), but does not say what the ACM has contributed. That says something about how the DSA allocates power, and about what the Netherlands gains and loses from being home to a major platform.
The case for Brussels taking the lead
The strongest argument for central enforcement is simple. Booking.com has been designated a very large online platform (VLOP) since April 2023 and reports more than 45 million monthly users in the EU. A fake listing aimed at a German tourist in Portugal harms people in several member states. A national regulator would struggle to assess that risk alone, and a company could in theory be tempted to favour its home regulator. Under the DSA, the Commission supervises VLOPs directly, so one rulebook is applied once across the single market. The Commission also built a record before opening the case. According to TheNextWeb, it reviewed risk assessments from this year and each of the previous three.
This is a fair design. A patchwork of 27 national interpretations of "systemic risk" would be worse for innovation than one demanding but predictable standard.
What the ACM does
The ACM is still central to DSA enforcement in the Netherlands. It is the Dutch Digital Services Coordinator. In its 2025 DSA annual report, published on 23 June 2026, it lists protecting minors, tackling illegal practices and securing the online environment around elections as its priorities. Those are mostly questions about smaller services and national contexts, which is where a national coordinator adds value. It also sits in the EU network of coordinators, so it can pass on complaints and local evidence to Brussels.
The Booking.com case is therefore a test of that cooperation, not a sign that the ACM has been sidelined. Dutch consumers and Dutch hosts are among the people affected. Whether the Commission uses what national authorities know, and says so publicly, is a legitimate question to put to it. Coverage of the announcement says the Commission is working with the ACM, but not what the ACM has contributed.
Why the Dutch angle matters
The Netherlands is the home base for several global platforms. The country's regulatory choices shape its reputation as a place to build digital businesses. Two risks follow.
The first is that having a platform in Amsterdam produces no national supervisory role, so the Dutch government carries political responsibility without enforcement power. If a scam on a Dutch-established platform defrauds citizens, local voters will look to The Hague rather than Brussels.
The second is overlap. Booking.com is not a pure social network. It operates a marketplace with commercial relationships between guests and hosts. Consumer protection, data protection and platform risk rules all apply to it, and each has its own enforcer. The Dutch data protection authority has a defined DSA remit only for specific provisions on advertising to profiled users and minors. A platform facing parallel inquiries under the DSA, the GDPR and consumer law needs clarity on which regulator is asking for what.
Proportionality: the real test
The Commission has described this as a case about alleged failures and has not announced findings. The fine ceiling is large. The DSA allows penalties of up to 6% of global annual turnover, and Booking.com can also offer commitments. Commitments are the better outcome for most cases like this one. A negotiated set of measures on listing verification and ad labelling can be put into effect faster than a contested non-compliance decision, which can be appealed for years.
Three principles should guide the case.
- Target the harm. Fake listings and phishing defraud real travellers. Verification and faster takedown of fraudulent listings are reasonable obligations for a marketplace that profits from bookings.
- Keep duties proportionate. Requiring hosts to prove identity is sensible. Requiring pre-screening of every listing and message would be costly and would push small genuine hosts off the platform.
- Label ads clearly, without banning ranking. Users should be able to tell paid placement from organic results. Paid placement itself is a normal business model and not in itself a breach.
The case also follows an April 2026 incident in which Booking.com told some customers that an unauthorised third party had accessed reservation-related information, according to TheNextWeb, which cited DutchReview. That strengthens the argument that how shared data is protected is a legitimate part of the risk assessment. It does not show that any DSA article has been breached.
What to watch
There is no fixed deadline, so the process may run for many months. The useful signals are procedural: whether the Commission publishes its preliminary findings, whether Booking.com offers commitments, and whether the ACM's contribution or that of other Dutch bodies is described. Dutch policymakers should also use the ACM's coordination role to push for clear public information on who supervises what. That would protect the Netherlands' standing as a place to build platforms without taking supervision away from the Commission.