WHAT THE POLICIES SAY

Booking.com is the flagship online travel agency of Booking Holdings Inc. (NASDAQ: BKNG), a Delaware-incorporated public company operating five consumer brands: Booking.com, Priceline, Agoda, KAYAK, and OpenTable. Its Privacy Notice for Travelers (updated May 2026) describes automatic collection of IP address, clicks, and device details — used among other things to determine the pricing displayed to each user — plus Genius loyalty profiling from booking history. Data may be shared within the Booking Holdings group and with advertising partners via hashed-identifier matching. The Dutch DPA fined Booking.com EUR 475,000 in 2021 for late notification of a 2018 breach in which criminals compromised hotel-partner accounts, and the company's SEC filings acknowledge ongoing phishing and account-takeover attacks. Booking.com is a designated Very Large Online Platform under the EU Digital Services Act.

TRACK RECORD

1 ENFORCEMENT ACTION

[2021-04-06]

In a press release dated 6 April 2021, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) announced a EUR 475,000 fine against Booking.com for reporting a data breach too late: in December 2018, criminals used a telephone scam targeting 40 hotels in the United Arab Emirates to obtain hotel staff log-in details for a Booking.com system, accessing personal data of 4,109 customers and credit card information of 283 people.

web.archive.org ↗

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

9 ON FILE

[2026-05-01] · COLLECTION

Booking.com's Privacy Notice for Travelers (updated May 2026) states that the platform automatically collects IP address, usage dates and times, clicks and page views, referral information, and device details whether or not the user makes a reservation; that displayed pricing is determined using the user's IP address, device type, and referring site; and that Genius loyalty benefits are calculated using account information, country, and past bookings.

booking.com ↗

OWNERSHIP TRANSPARENCY

The European Commission's official list of designated very large online platforms shows Booking.com (provider Booking.com B.V., main establishment in the EU) was designated a Very Large Online Platform under the Digital Services Act on 25 April 2023, with above 45 million average monthly active users in the EU and the Netherlands as its Digital Services Coordinator — subjecting it to DSA transparency and systemic-risk obligations.

digital-strategy.ec.europa.eu ↗

[2026-02-18] · OWNERSHIP TRANSPARENCY

Booking Holdings Inc.'s Form 10-K for fiscal year 2025, filed with the U.S. Securities and Exchange Commission on 2026-02-18 (Commission File Number 1-36691, Delaware incorporated), discloses that the company offers its services through five primary consumer-facing brands: Booking.com, Priceline, Agoda, KAYAK, and OpenTable.

sec.gov ↗

[2026-05-01] · OWNERSHIP TRANSPARENCY

Booking.com's Privacy Notice for Travelers (updated May 2026) itself discloses the corporate ownership chain, naming Booking Holdings Inc. (BHI) as its parent company and identifying sibling brands such as Agoda and Priceline, with a link to the parent company's website.

booking.com ↗

[2026-05-01] · SHARING

The Privacy Notice for Travelers (updated May 2026) permits sharing personal data within the Booking Holdings Inc. group (e.g., Agoda or OpenTable) and sharing identifiers such as hashed email addresses and telephone numbers with advertising partners for audience matching; it states audience insights shared with advertisers are aggregated and pseudonymized (including via data clean rooms), and its California section provides an opt-out of the selling or sharing of personal information and of cross-context behavioral advertising.

booking.com ↗

[2021-04-06] · TRACK RECORD

web.archive.org ↗

[2024-09-10] · TRACK RECORD

In a newsroom article dated 10 September 2024 ('Online Travel Scams Are on The Rise. Here's How to Stay Safe'), Booking.com publicly acknowledged the rise in online travel scams and phishing targeting travelers, published anti-scam guidance (including warnings about urgent payment requests and requests to pay outside the platform), and offered interviews with its Chief Security Officer Marnie Wilking on travel cybercrime.

news.booking.com ↗

[2026-02-18] · TRACK RECORD

Booking Holdings' Form 10-K for fiscal year 2025 (filed 2026-02-18) discloses that the company has experienced targeted and organized malware, phishing, and account takeover attacks, and has incurred costs for customer reimbursement, reputational harm, and lost revenue from fictitious listings and account takeovers; the same filing describes a security program measured annually against NIST frameworks with third-party assessments every other year and board-level cybersecurity oversight.

sec.gov ↗

[2026-05-01] · TRACKING TECH

The Privacy Notice for Travelers (updated May 2026) states that personalized marketing draws on behavioral data collected via cookies and similar tracking technologies, and that personalized marketing is shown on the Booking.com website, mobile apps, and third-party websites and apps; Booking.com also receives aggregated information from social media and marketing partners to measure advertising effectiveness.

booking.com ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7