Booking.com's privacy policy has been reorganized to separate US (non-California) residents from California residents, with California-specific protections removed and replaced with broader US state privacy language. New sections have been added describing data sharing related to a co-branded credit card product with Imprint Payments, Inc. Key consumer rights such as the ability to limit use of sensitive personal information have been removed from the policy.
Consumers: You can no longer ask Booking.com to restrict sensitive data (like immigration status, health, or sexual orientation) to only what is necessary to provide services.
Consumers: The policy no longer explicitly states you can ask Booking.com not to use your data for behavioral advertising across different websites and apps.
Consumers: Booking.com now discloses that it shares personal data with Imprint Payments when you apply for a Genius Reward Visa Signature credit card, and that Imprint acts as an independent controller of that data.
The updated policy removes California residents' right to limit use and disclosure of sensitive personal information, which previously required Booking.com to restrict sensitive data use to what was necessary for service delivery. The policy now treats California residents under broader US state privacy rules rather than California-specific protections. Additionally, the policy now discloses data sharing with Imprint Payments, Inc. for a co-branded credit card program, meaning personal data will be shared with a third party acting as an independent controller when you apply for the card. You can review the card terms and conditions provided at application to understand how Imprint Payments will use your data before applying.
→ Review the credit card terms and conditions provided at application before applying for the Genius Reward Visa Signature card to understand how Imprint Payments, Inc. will use your personal data.
→ If you have concerns about Booking.com's use of sensitive personal information, contact Booking.com directly to ask about their current policies, as the policy no longer explicitly grants the right to limit such use.
ConductAtlas has recorded 2 material changes to this document (since April 2026). An additional minor or cosmetic changes were excluded.
Across all monitored documents, Booking.com has made 4 significant changes.
3 of Booking.com's significant changes have been classified as negative for consumers.
Removed the right for California consumers to ask Booking.com to limit use of sensitive personal information to what is necessary for service delivery.
Removed explicit disclosure of the right to opt out of cross-context behavioral advertising.
Added disclosure that Booking.com shares personal data with Imprint Payments, Inc. for co-branded credit card processing, and that Imprint acts as an independent data controller.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
This change removes explicit language protecting sensitive personal information in California and restructures regional privacy disclosures to treat California residents under generic US state privacy frameworks rather than California-specific law. It adds a new vendor …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001387.
The change appears to be a technical update to Booking.com's WAF (Web Application Firewall) challenge page, updating nonce values and …
The detected change consists of updates to nonce values and timestamps in the HTML security infrastructure of Booking.com's challenge page, …
The detected change in Booking.com's published document consists entirely of technical updates to nonce values and timestamp parameters in the …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.