Verified hotel stars move into focus as the EU investigates Booking.com

A property that does not actually exist. A copied hotel listing designed to inspire trust with someone else’s photos and stars. Or a payment request that appears to come straight from the hotel that was booked. Scams like these have kept booking platforms and the hotel industry busy for years. Now the European Commission is taking a closer look at Booking.com. On 21 October 2026, it opened formal proceedings under the Digital Services Act (DSA). The case is not only about travellers’ safety but also about the responsibility of a platform through which hotels sell their rooms every day.¹

For many hoteliers, Booking.com is an important sales channel. Any changes resulting from the proceedings could therefore be far-reaching. However, it is by no means established that the company has breached European law. For now, the Commission is examining whether Booking.com has adequately assessed and effectively mitigated certain risks and transparently labelled paid-for placements.

Markus Luthe, President of the European Hotelstars Union, sees an option that is already available today, particularly when it comes to verifying hotel listings. In a written interview with eingecheckt®, he explains why official hotel stars can do more than simply show a hotel’s standard of facilities.

What the European Commission is examining

The investigation focuses on three areas. First, the Commission wants to establish whether Booking.com takes sufficient action against fake or non-compliant accommodation listings. These include listings for properties that do not exist as well as cases in which fraudsters use the identity of real hosts.

The second focus is phishing. Among other things, the Commission is examining the risks arising from sharing booking and guest data with accommodation providers and whether Booking.com’s messaging system is adequately protected against misuse. Fraudsters can exploit genuine booking information to send deceptively credible payment requests.¹

A third point concerns how hotels are ranked in search results. Hosts can make their listings more visible by paying a higher commission. The Commission is examining whether such paid-for boosts are clearly recognisable to users as advertising. It is also looking at whether the required information about who paid for an ad and how it works is provided.¹

The legal basis is primarily Articles 34 and 35 of the DSA on the assessment and mitigation of systemic risks, and Article 26(1) on advertising transparency. Booking.com has been designated a very large online platform since 25 April 2023 and is therefore subject to particular European obligations.¹

The proceedings do not come as a surprise. Before opening them, the Commission had already analysed risk assessment reports from 2023 to 2026 and requested additional information from Booking.com. The Dutch Authority for Consumers and Markets (ACM) is also involved.¹

Why a hotel star can be more than a search filter

While the Commission is looking at several possible weaknesses, Hotelstars Union is focusing on one specific part of the problem: the authenticity and reliability of hotel information.

On booking platforms, stars are among a hotel’s most prominent features. They appear next to its name and can be used as a filter when searching for accommodation. For travellers, they create certain expectations about facilities and quality. However, not every star category shown on a portal is the result of an official classification.

Hotelstars Union is therefore calling for star ratings to be matched directly against its verified data. A corresponding interface is available to Booking.com and other platforms free of charge.²

Asked why official stars could also help against fake listings, Luthe told eingecheckt®:

“Official stars are only awarded after an audit, and every audit includes an on-site visit. An independent commission checks every criterion at the property itself.”

This means the stars are not assigned to just any online profile, but to a hotel that has actually been inspected at a specific address. During classification, the inspectors also check whether the hotel’s online presentation matches reality. This includes the mandatory website with realistic images.

If a booking platform took star ratings exclusively from the official database, fraudsters could not simply assign an official category to a made-up hotel. Nor could the stars of the genuine hotel easily be carried over to a copied listing.

Luthe puts the possible effect clearly:

“Anyone who copies the listing of a frequently booked classified hotel can no longer copy its official stars as well.”

This would not rule out every form of accommodation fraud. Fake listings without stars could still exist, and phishing would not automatically be prevented either. But in search results where travellers specifically look for classified hotels, reliable data matching could create an additional hurdle for fraudsters.

Other platforms already match star ratings

The proposed solution is by no means new. As Luthe explains, Tripadvisor has been automatically matching its data with the official classification data since 2022. Expedia also draws on the database and explicitly names Hotelstars Union as its source in several countries. On Google, the label “X-star hotel” appears only for officially classified hotels.

“The principle is simple: the platform no longer takes the stars from the hotel’s own information, but from our interface,” Luthe explains. “We make this interface available to all platforms, including Booking.com, free of charge.”

The debate also has a legal history. In November 2025, the Dutch advertising standards body Reclame Code Commissie ruled that the way hotel stars were displayed on Booking.com was misleading. In April 2026, the appeals body upheld this assessment. Since then, Hotelstars Union has once again called for cooperation with the booking platform.²

Whether the European Commission will actually make mandatory matching with official classification data part of any remedies remains open. The demand comes from Hotelstars Union; it is not a measure ordered by the EU.

For small independent hotels, fair visibility is also at stake

Behind the debate about stars lies a second question that many hoteliers are likely to consider at least as important: how can hotels that undergo independent classification benefit from this proof of quality on booking platforms?

Luthe sees disadvantages particularly for smaller, owner-run hotels when officially verified stars and unverified information can hardly be told apart in search results.

“Today they appear on the same results page as providers who enter their own stars, and guests can hardly tell the difference.”

After all, a star rating means effort for a classified hotel. It has to meet defined criteria, undergo an inspection and renew its classification regularly. If this proof is not clearly visible online, it loses part of its value.

In Luthe’s view, consistently correct display of official stars could therefore improve the visibility of independent hotels in particular. He also points out that booking portals and AI assistants increasingly rely on trustworthy, structured data. As a result, official classification is becoming more important for hotel marketing in the future.

What Booking.com and the associations say

Booking.com has said it is cooperating fully with the European Commission and will engage constructively on its questions under the DSA. The company stresses that safety, trust and the protection of personal information are top priorities. It also points to its work with authorities and industry partners to combat cybercrime and online fraud.³

The German Hotel Association (IHA) reacted far more critically. In a statement on the opening of the proceedings, Markus Luthe, in his role as IHA chief executive, said:

“The Commission has finally opened formal proceedings against Booking.com under the Digital Services Act. Anyone who controls the channel to the guest cannot simply shift responsibility for their safety onto hotels and guests. Safe booking must not be a gamble.”⁴

The industry associations have been aware of the security problems for some time. In recent years, IHA and HSMA have repeatedly warned of phishing attacks in which hotel accounts and the messaging systems of booking platforms, among other things, are misused.

This leaves hoteliers with a difficult question: on the one hand, they have to protect their own systems and logins. On the other, they have only limited influence over the technical security measures of a large booking platform.

What the proceedings could actually change

The European Commission now wants to gather further evidence. To do so, it can request additional information, conduct interviews or carry out inspections. Possible next steps include interim measures, a formal finding of non-compliance or the acceptance of binding commitments from Booking.com.¹

If the Commission finds an infringement of the DSA, the legal framework also allows fines of up to six per cent of global annual turnover. This is the general ceiling under the DSA, not an announced sanction against Booking.com.⁵

There is no fixed statutory deadline by which the proceedings must be concluded. Whether Booking.com will have to change its messaging system, how it checks listings, how it displays hotel stars or how it labels paid-for placements is therefore still undecided.

For hotels, this means for now: sales via Booking.com continue. At the same time, issues that many businesses have so far regarded as technical details are moving into the spotlight – from the accuracy of their hotel information to the security of their guest communication.

What hotels can do now

Regardless of the outcome of the EU proceedings, hoteliers can review their own information and security precautions. Luthe’s recommendations and the existing DSA rules point to a number of concrete steps.

Under the DSA, platforms must accept notices of allegedly illegal content through suitable reporting mechanisms and process them in a timely, diligent and objective manner. However, a notice does not automatically lead to a listing being removed.

Proceedings with consequences beyond Booking.com

It is not yet possible to say what the European investigation will lead to. For Booking.com, the question is whether its existing measures on risk assessment, fraud prevention and advertising transparency meet the legal requirements. For hoteliers, it is also about trust in a sales channel on which many businesses depend.

With the matching of official classification data, Hotelstars Union is putting a concrete proposal into the debate. It could improve the reliability of star ratings and make certain types of fake hotel profiles more difficult, without being able to solve every security problem.

Whether Booking.com will take this route remains open. According to Hotelstars Union, the technical requirements for such cooperation are already in place.