Old version
April 2, 2026 06:05 UTC
1ba9eb715c989d70fd223edb6044086cf85ec5fd0d604dcdfe2cf94c49f7291e
CA-V-001740
New version
April 3, 2026 05:39 UTC
f8c40f9866d79220e0baea2948e7f39e7bb8676c791c2da21e062dd63c0ef0c3
CA-V-001751
Share 𝕏 Share in Share
Change Summary
Booking.com updated technical security infrastructure in their Terms and Conditions document on April 3, 2026. The change involved updating nonce values and challenge timestamp parameters used for bot-detection and security verification on their website. This is a routine technical update with no material change to user rights, data practices, or service terms.
low severity
0 Sentences added
0 Sentences removed
1 Sentences modified
3 Sentences before
3 Sentences after
Added
Removed
Modified
BeforeAfter
0<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title></title> <style> body { font-family: "Arial"; } </style> <script type="text/javascript" nonce="17751099238310.22433067832349785"> function getAjaxObject() { var ajax; if (window.XMLHttpRequest) { try { ajax = new window.XMLHttpRequest(); // XMLHttpRequest (Mozilla, Opera, Safari, etc.) } catch (e) { return false; } } else { var msXML = new Array( // XMLHttpRequest (IE with ActiveX) "Msxml2.XMLHTTP.5.0", "Msxml2.XMLHTTP.4.0", "Msxml2.XMLHTTP.3.0", "Msxml2.XMLHTTP", "Microsoft.XMLHTTP" ); for (var i = 0; i < msXML.length; i++) { // We want to get the best we can try { ajax = new ActiveXObject(msXML[i]); break; } catch (e) { return false; } } } return ajax; } function sendAjaxRequest(url, data, callback) { const xhr = getAjaxObject(); if (!xhr) { callback(new Error('Unable to create XMLHttpRequest object'), null); return; } xhr.open('POST', url, true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.setRequestHeader('Accept', 'application/json'); xhr.onreadystatechange = function() { if (xhr.readyState === 4) { if (xhr.status >= 200 && xhr.status < 300) { try { const response = JSON.parse(xhr.responseText); callback(null, response); } catch (error) { callback(error, null); } } else { callback(new Error('HTTP error! status: ' + xhr.status), null); } } }; xhr.onerror = function() { callback(new Error('Network error'), null); }; xhr.send(JSON.stringify(data)); } function reportChallengeError(log, challengeError) { try { sendAjaxRequest( 'https://reports.booking.com/chal_report', { log: log, message: challengeError.message, stack: challengeError.stack }, (e, response) => { if (e) { console.error('Request failed:', e); } else { console.log('Success:', response); } } ); } catch (e) {} } function setupErrorHandling() { // Handle JavaScript errors window.addEventListener('error', function(event) { var error = { message: event.message, stack: event.error ? event.error.stack : '' }; reportChallengeError('javascript_error', error); }); // Handle unhandled promise rejections window.addEventListener('unhandledrejection', function(event) { var error = { message: event.reason && event.reason.message ? event.reason.message : 'Unhandled Promise Rejection', stack: event.reason && event.reason.stack ? event.reason.stack : '' }; reportChallengeError('promise_rejection', error); }); } // Initialize error handling setupErrorHandling(); </script> <script type="text/javascript" nonce="17751099238310.22433067832349785"> window.awsWafCookieDomainList = ['booking.com']; </script> <script type="text/javascript" src="https://www.booking.com/__challenge_h78IRKX3kpQxScCExxShBNwRUlb/d8c14d4960ca/a18a4859af9c/challenge.js" nonce="17751099238310.22433067832349785"></script> <script type="text/javascript" nonce="17751099238310.22433067832349785"> const maxLocationLength = 2047 - "&chal_t=1760623098515&force_referer=".length; function searchStringWithNewParam(search, key, value) { value = encodeURIComponent(value); if (!search.startsWith('?')) { return search + `?${key}=${value}`; } else if (search.endsWith('&')) { return search + `${key}=${value}`; } else { return search + `&${key}=${value}`; } } function getNewUrlWithAddedParameter(location, parameters) { let newSearch = location.search; for (let parameterName of Object.keys(parameters)) { if (!newSearch.includes(`${parameterName}=`)) { newSearch = searchStringWithNewParam(newSearch, parameterName, parameters[parameterName]); } } let newHref = `${location.pathname}${newSearch}${location.hash}`; if (newHref.length < maxLocationLength) { return newHref; } return null; } </script> </head> <body> <div id="challenge-container"></div> <script type="text/javascript" nonce="17751099238310.22433067832349785"> let newHref; try { setTimeout(() => { try { reportChallengeError("Reloaded without updating url", new Error("")); } catch (e) {} document.location.reload(); }, 20000); let referrer = document.referrer; let availableLength = maxLocationLength - document.location.href.length; if (encodeURIComponent(referrer).length > availableLength) { let parsedReferrer = new URL(referrer); referrer = parsedReferrer.origin; if (encodeURIComponent(referrer + parsedReferrer.pathname).length < availableLength) { referrer = referrer + parsedReferrer.pathname; } } let parameters = { chal_t: 1775109923831, force_referer: referrer, }; newHref = getNewUrlWithAddedParameter(document.location, parameters); } catch (e) { reportChallengeError("Failed while getting new href", e); } newHref = newHref || document.location.href; AwsWafIntegration.saveReferrer(); AwsWafIntegration.checkForceRefresh().then((forceRefresh) => { if (forceRefresh) { AwsWafIntegration.forceRefreshToken().then(() => { window.location.href = newHref; }); } else { AwsWafIntegration.getToken().then(() => { window.location.href = newHref; }); } }); </script> <noscript> <h1>JavaScript is disabled</h1> In order to continue, we need to verify that you're not a robot.0<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title></title> <style> body { font-family: "Arial"; } </style> <script type="text/javascript" nonce="17751947523080.5174815136627605"> function getAjaxObject() { var ajax; if (window.XMLHttpRequest) { try { ajax = new window.XMLHttpRequest(); // XMLHttpRequest (Mozilla, Opera, Safari, etc.) } catch (e) { return false; } } else { var msXML = new Array( // XMLHttpRequest (IE with ActiveX) "Msxml2.XMLHTTP.5.0", "Msxml2.XMLHTTP.4.0", "Msxml2.XMLHTTP.3.0", "Msxml2.XMLHTTP", "Microsoft.XMLHTTP" ); for (var i = 0; i < msXML.length; i++) { // We want to get the best we can try { ajax = new ActiveXObject(msXML[i]); break; } catch (e) { return false; } } } return ajax; } function sendAjaxRequest(url, data, callback) { const xhr = getAjaxObject(); if (!xhr) { callback(new Error('Unable to create XMLHttpRequest object'), null); return; } xhr.open('POST', url, true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.setRequestHeader('Accept', 'application/json'); xhr.onreadystatechange = function() { if (xhr.readyState === 4) { if (xhr.status >= 200 && xhr.status < 300) { try { const response = JSON.parse(xhr.responseText); callback(null, response); } catch (error) { callback(error, null); } } else { callback(new Error('HTTP error! status: ' + xhr.status), null); } } }; xhr.onerror = function() { callback(new Error('Network error'), null); }; xhr.send(JSON.stringify(data)); } function reportChallengeError(log, challengeError) { try { sendAjaxRequest( 'https://reports.booking.com/chal_report', { log: log, message: challengeError.message, stack: challengeError.stack }, (e, response) => { if (e) { console.error('Request failed:', e); } else { console.log('Success:', response); } } ); } catch (e) {} } function setupErrorHandling() { // Handle JavaScript errors window.addEventListener('error', function(event) { var error = { message: event.message, stack: event.error ? event.error.stack : '' }; reportChallengeError('javascript_error', error); }); // Handle unhandled promise rejections window.addEventListener('unhandledrejection', function(event) { var error = { message: event.reason && event.reason.message ? event.reason.message : 'Unhandled Promise Rejection', stack: event.reason && event.reason.stack ? event.reason.stack : '' }; reportChallengeError('promise_rejection', error); }); } // Initialize error handling setupErrorHandling(); </script> <script type="text/javascript" nonce="17751947523080.5174815136627605"> window.awsWafCookieDomainList = ['booking.com']; </script> <script type="text/javascript" src="https://www.booking.com/__challenge_h78IRKX3kpQxScCExxShBNwRUlb/d8c14d4960ca/a18a4859af9c/challenge.js" nonce="17751947523080.5174815136627605"></script> <script type="text/javascript" nonce="17751947523080.5174815136627605"> const maxLocationLength = 2047 - "&chal_t=1760623098515&force_referer=".length; function searchStringWithNewParam(search, key, value) { value = encodeURIComponent(value); if (!search.startsWith('?')) { return search + `?${key}=${value}`; } else if (search.endsWith('&')) { return search + `${key}=${value}`; } else { return search + `&${key}=${value}`; } } function getNewUrlWithAddedParameter(location, parameters) { let newSearch = location.search; for (let parameterName of Object.keys(parameters)) { if (!newSearch.includes(`${parameterName}=`)) { newSearch = searchStringWithNewParam(newSearch, parameterName, parameters[parameterName]); } } let newHref = `${location.pathname}${newSearch}${location.hash}`; if (newHref.length < maxLocationLength) { return newHref; } return null; } </script> </head> <body> <div id="challenge-container"></div> <script type="text/javascript" nonce="17751947523080.5174815136627605"> let newHref; try { setTimeout(() => { try { reportChallengeError("Reloaded without updating url", new Error("")); } catch (e) {} document.location.reload(); }, 20000); let referrer = document.referrer; let availableLength = maxLocationLength - document.location.href.length; if (encodeURIComponent(referrer).length > availableLength) { let parsedReferrer = new URL(referrer); referrer = parsedReferrer.origin; if (encodeURIComponent(referrer + parsedReferrer.pathname).length < availableLength) { referrer = referrer + parsedReferrer.pathname; } } let parameters = { chal_t: 1775194752308, force_referer: referrer, }; newHref = getNewUrlWithAddedParameter(document.location, parameters); } catch (e) { reportChallengeError("Failed while getting new href", e); } newHref = newHref || document.location.href; AwsWafIntegration.saveReferrer(); AwsWafIntegration.checkForceRefresh().then((forceRefresh) => { if (forceRefresh) { AwsWafIntegration.forceRefreshToken().then(() => { window.location.href = newHref; }); } else { AwsWafIntegration.getToken().then(() => { window.location.href = newHref; }); } }); </script> <noscript> <h1>JavaScript is disabled</h1> In order to continue, we need to verify that you're not a robot.
Stay ahead of the changes

Watch this before it changes again

Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.