Consumer Apps · Travel · Private litigation
Booking.com
Headline
European hoteliers have banded together to sue Booking.com — more than 10,000 European hotels were reportedly part of a collective action as of July 2026 over alleged anti-competitive practices, including restrictions…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
European hoteliers have banded together to sue Booking.com — more than 10,000 European hotels were reportedly part of a collective action as of July 2026 over alleged anti-competitive practices, including restrictions on hotels' freedom to set prices. Meanwhile, legal guides advising ordinary consumers on suing online travel sites warn plainly that Booking.com's own Terms are 'pretty one-sided' and 'strictly limit your right to any recourse,' with disclaimers that courts have historically enforced. The same booking platform under fire from hotels for unfair commissions has terms that make it just as hard for the CUSTOMER on the other end to fight back.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
Booking.com has disclosed at least two separate data-exposure incidents: (1) a breach where 'unauthorized parties' accessed customer details (financial information reportedly NOT compromised, per the company's own statement); (2) a 2020 third-party vendor exposure (Prestige Software, a Spain-based channel-manager provider whose misconfigured AWS S3 bucket held more than 10 million reservation log files, including card details, tied to bookings via Booking.com, Expedia, Hotels.com, Agoda and others, per Website Planet) that briefly left large volumes of reservation data unsecured — illustrating a broader travel-industry pattern where breaches increasingly originate from third-party vendors/supply-chain partners rather than the travel company's own systems directly (the same source article notes similar third-party-caused breaches at Eurail, KLM/Air France, and Hertz/Dollar/Thrifty in 2025–2026).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (BKNG). Service route: c/o General Counsel / Corporate Secretary, Norwalk, Connecticut — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy booking.com/content/privacy.html | Not fetched yet | NO (HTML only) |
| Terms of service booking.com/content/terms.html | Not fetched yet | NO (HTML only) |
| Website bookingholdings.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Connecticut. Provisions of CTDPA on file:
| Provision | Type | Source |
|---|---|---|
| Sensitive Data — Opt-In Consent Required Conn. Gen. Stat. § 42-515(38); § 42-520(a)(4) | hard | source |
| Applicability Threshold Conn. Gen. Stat. § 42-516 | threshold | source |
| Universal Opt-Out Mechanism — GPC Recognition Required Conn. Gen. Stat. § 42-518 | hard | source |
| Right to Access Conn. Gen. Stat. § 42-518(a)(1) | hard | source |
| Right to Correction Conn. Gen. Stat. § 42-518(a)(2) | hard | source |
| Right to Deletion Conn. Gen. Stat. § 42-518(a)(3) | hard | source |
| Right to Data Portability Conn. Gen. Stat. § 42-518(a)(4) | hard | source |
| Right to Opt Out of Sale, Targeted Advertising, and Profiling Conn. Gen. Stat. § 42-518(a)(5) | hard | source |
| Right to Appeal Denied Request Conn. Gen. Stat. § 42-518(c) | hard | source |
| Privacy Notice Requirements Conn. Gen. Stat. § 42-520(c) | hard | source |
| Privacy Notice — Personal Data Used to Train Large Language Models Conn. Gen. Stat. § 42-520, as amended by 2025 Conn. Pub. Acts 25-113 (SB 1295, enacted June 24, 2025; July 1, 2026 effective date and the LLM-training notice requirement confirmed via Hunton Andrews Kurth summary; subsection pinpoint not verified against the Public Act text) | hard | source |
| Processor Contract Requirements Conn. Gen. Stat. § 42-521 | hard | source |
| Automated Decision-Making Technology — Impact Assessment Conn. Gen. Stat. § 42-522, as amended by 2025 Conn. Pub. Acts 25-113 | hard | source |
| Enforcement — AG Only; Civil Penalties Conn. Gen. Stat. § 42-525 | hard | source |
| Teen Protections — Ages 13 to 15 Conn. Gen. Stat. §§ 42-515 et seq. (2023 amendments) | hard | source |
| ADMT Disclosure — LLM Training Data and Profiling Contest Right (Eff. July 1, 2026) Conn. Gen. Stat. §§ 42-518(a)(6), 42-520(b)(1)(H), 42-522(c) (as amended by P.A. 25-113, eff. July 1, 2026) | hard | source |