Booking.com reorganized its privacy notice to separate California residents' data rights from the general US privacy section. The updated section now explicitly lists the 10 categories of personal information California law recognizes, clarifies what counts as a 'sale' of data under California law, and adds three new consumer rights: the ability to opt out of data sales, opt out of cross-context behavioral advertising, and limit use of sensitive personal information. These changes reflect California's privacy law requirements and give California residents more granular control over how their data is used.
California residents now have three explicit opt-out mechanisms that did not exist before: they can request Booking.com not to sell or share their personal information with third parties, opt out of cross-context behavioral advertising, and ask the company to limit use of sensitive personal information to what is necessary to provide services. Booking.com also clarified the 10 categories of personal information it may collect (identifiers, financial info, protected characteristics, commercial information, internet activity, geolocation, audio/visual, professional information, inferences, and sensitive information) in language aligned with California law. You can review the 'Your rights' section of Booking.com's updated privacy notice to understand how to submit an opt-out request or limit use of your sensitive data.
California law (CPRA) grants residents specific rights over their data that Booking.com did not previously disclose in its main privacy notice. By separating California disclosures and adding explicit opt-out mechanisms, the updated policy clarifies which data categories the company collects, how it may share them, and what control consumers have. This matters because California residents now have actionable mechanisms to opt out of practices they may not have known were occurring.
→ Review the updated 'California' section of Booking.com's privacy notice to understand the 10 categories of personal information collected and what 'sale or sharing' means under California law.
→ If you do not want Booking.com to sell or share your personal data with third parties, submit an opt-out request through the 'Your rights' section of the policy.
→ If you do not want Booking.com to use your data for cross-context behavioral advertising, submit an opt-out request for that specific purpose through your account settings or the designated request process.
→ Booking.com may continue to sell or share your personal information with third parties, including identifiers, commercial information, geolocation, and internet activity data, unless you submit an explicit opt-out request.
→ Booking.com may continue to use your data for cross-context behavioral advertising unless you submit an opt-out request.
→ Booking.com may use sensitive personal information (such as passport numbers, driver's license data, or account sign-in credentials) beyond what is minimally necessary to provide services unless you request a limit on sensitive data use.
ConductAtlas has recorded 3 material changes to this document (since April 2026). An additional minor or cosmetic changes were excluded.
Across all monitored documents, Booking.com has made 6 significant changes.
4 of Booking.com's significant changes have been classified as negative for consumers.
Added detailed list of 10 CPRA-defined categories (identifiers, financial info, protected characteristics, commercial information, internet activity, geolocation, audio/visual, professional information, inferences, sensitive information) replacing prior generic references.
New explicit consumer right to request Booking.com not sell or share data with third parties, covering identifiers, commercial information, geolocation, internet activity, and inferences.
New explicit consumer right to request Booking.com not use personal data for behavioral advertising across contexts.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
You can tell Booking.com to stop selling or sharing your data with other companies.
You can ask Booking.com not to track your behavior across websites to show you targeted ads.
+ 2 more obligation changes. Full breakdown available with Monitor.
Track changes →Booking.com restructured its privacy notice to create a separate California-specific section that implements California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) disclosure and opt-out mechanisms. The change adds explicit acknowledgment of the 'sale or sharing' definition under CPRA, establishes three consumer rights (opt-out of sale/sharing, opt-out of cross-context behavioral advertising, and limit use of sensitive information), and imposes a verification obligation on the company before processing requests. Organizations that have Booking.com in their vendor stack should assess whether this change affects privacy impact assessments, data processing agreements, or privacy notice templates that reference vendor practices.
California Consumer Privacy Act (CCPA); California Privacy Rights Act (CPRA); California Online Privacy Protection Act (CalOPPPA)
Full compliance analysis
Obligation analysis, escalation trigger, board language, and recommended action.
Monitor: regulatory citations + obligations. Compliance: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001410.
See the full side-by-side comparison of every sentence added, removed, and modified.
🔒 Full diff — MonitorThe change appears to be a technical update to Booking.com's WAF (Web Application Firewall) challenge page, updating nonce values and …
The detected change consists of updates to nonce values and timestamps in the HTML security infrastructure of Booking.com's challenge page, …
The detected change in Booking.com's published document consists entirely of technical updates to nonce values and timestamp parameters in the …
Get alerted when this policy changes again — including what changed and why it matters.
Prefer a weekly summary instead?
Get the biggest policy changes across 320+ platforms every Sunday.