Booking.com reorganized its privacy notice to separate California residents' data rights from the general US privacy section. The updated section now explicitly lists the 10 categories of personal information California law recognizes, clarifies what counts as a 'sale' of data under California law, and adds three new consumer rights: the ability to opt out of data sales, opt out of cross-context behavioral advertising, and limit use of sensitive personal information. These changes reflect California's privacy law requirements and give California residents more granular control over how their data is used.
Consumers: You can tell Booking.com to stop selling or sharing your data with other companies.
Consumers: You can ask Booking.com not to track your behavior across websites to show you targeted ads.
Consumers: You can ask Booking.com to only use your sensitive data (like passport numbers or medical info) when absolutely needed to serve you.
Consumers: Booking.com will check who you are before honoring a request to opt out of data sales or limit data use.
California residents now have three explicit opt-out mechanisms that did not exist before: they can request Booking.com not to sell or share their personal information with third parties, opt out of cross-context behavioral advertising, and ask the company to limit use of sensitive personal information to what is necessary to provide services. Booking.com also clarified the 10 categories of personal information it may collect (identifiers, financial info, protected characteristics, commercial information, internet activity, geolocation, audio/visual, professional information, inferences, and sensitive information) in language aligned with California law. You can review the 'Your rights' section of Booking.com's updated privacy notice to understand how to submit an opt-out request or limit use of your sensitive data.
→ Review the updated 'California' section of Booking.com's privacy notice to understand the 10 categories of personal information collected and what 'sale or sharing' means under California law.
→ If you do not want Booking.com to sell or share your personal data with third parties, submit an opt-out request through the 'Your rights' section of the policy.
→ If you do not want Booking.com to use your data for cross-context behavioral advertising, submit an opt-out request for that specific purpose through your account settings or the designated request process.
ConductAtlas has recorded 2 material changes to this document (since April 2026). An additional minor or cosmetic changes were excluded.
Added detailed list of 10 CPRA-defined categories (identifiers, financial info, protected characteristics, commercial information, internet activity, geolocation, audio/visual, professional information, inferences, sensitive information) replacing prior generic references.
New explicit consumer right to request Booking.com not sell or share data with third parties, covering identifiers, commercial information, geolocation, internet activity, and inferences.
New explicit consumer right to request Booking.com not use personal data for behavioral advertising across contexts.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Booking.com restructured its privacy notice to create a separate California-specific section that implements California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) disclosure and opt-out mechanisms. The change adds explicit acknowledgment of the …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001410.
The change appears to be a technical update to Booking.com's WAF (Web Application Firewall) challenge page, updating nonce values and …
The detected change consists of updates to nonce values and timestamps in the HTML security infrastructure of Booking.com's challenge page, …
Booking.com removed a dedicated privacy section that previously explained how it and its insurance partners handle personal data when you …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.