Old version
May 5, 2026 05:52 UTC
450993fe6cfac5f0944737afb9d504e0bc31bc8797f9a0e4ceec6947a395876a
CA-V-002133
New version
May 5, 2026 08:36 UTC
bcb3c386840c20e7b8a9da9542740f05fc2fc8f43cf74af608cb3b9087833187
CA-V-002171
Share 𝕏 Share in Share
Change Summary
The captured document appears to be a security challenge page (WAF/bot verification) rather than Booking.com's actual Terms and Conditions. The technical changes between versions involve only nonce values and timestamps used for security verification, with no material changes to consumer-facing terms, rights, or obligations.
low severity
0 Sentences added
0 Sentences removed
1 Sentences modified
3 Sentences before
3 Sentences after
Added
Removed
Modified
BeforeAfter
0<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title></title> <style> body { font-family: "Arial"; } </style> <script type="text/javascript" nonce="17779603389840.2908730088826338"> function getAjaxObject() { var ajax; if (window.XMLHttpRequest) { try { ajax = new window.XMLHttpRequest(); // XMLHttpRequest (Mozilla, Opera, Safari, etc.) } catch (e) { return false; } } else { var msXML = new Array( // XMLHttpRequest (IE with ActiveX) "Msxml2.XMLHTTP.5.0", "Msxml2.XMLHTTP.4.0", "Msxml2.XMLHTTP.3.0", "Msxml2.XMLHTTP", "Microsoft.XMLHTTP" ); for (var i = 0; i < msXML.length; i++) { // We want to get the best we can try { ajax = new ActiveXObject(msXML[i]); break; } catch (e) { return false; } } } return ajax; } function sendAjaxRequest(url, data, callback) { const xhr = getAjaxObject(); if (!xhr) { callback(new Error('Unable to create XMLHttpRequest object'), null); return; } xhr.open('POST', url, true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.setRequestHeader('Accept', 'application/json'); xhr.onreadystatechange = function() { if (xhr.readyState === 4) { if (xhr.status >= 200 && xhr.status < 300) { try { const response = JSON.parse(xhr.responseText); callback(null, response); } catch (error) { callback(error, null); } } else { callback(new Error('HTTP error! status: ' + xhr.status), null); } } }; xhr.onerror = function() { callback(new Error('Network error'), null); }; xhr.send(JSON.stringify(data)); } function reportChallengeError(log, challengeError) { try { sendAjaxRequest( 'https://reports.booking.com/chal_report', { log: log, message: challengeError.message, stack: challengeError.stack }, (e, response) => { if (e) { console.error('Request failed:', e); } else { console.log('Success:', response); } } ); } catch (e) {} } function setupErrorHandling() { // Handle JavaScript errors window.addEventListener('error', function(event) { var error = { message: event.message, stack: event.error ? event.error.stack : '' }; reportChallengeError('javascript_error', error); }); // Handle unhandled promise rejections window.addEventListener('unhandledrejection', function(event) { var error = { message: event.reason && event.reason.message ? event.reason.message : 'Unhandled Promise Rejection', stack: event.reason && event.reason.stack ? event.reason.stack : '' }; reportChallengeError('promise_rejection', error); }); } // Initialize error handling setupErrorHandling(); </script> <script type="text/javascript" nonce="17779603389840.2908730088826338"> window.awsWafCookieDomainList = ['booking.com']; </script> <script type="text/javascript" src="https://www.booking.com/__challenge_h78IRKX3kpQxScCExxShBNwRUlb/d8c14d4960ca/a18a4859af9c/challenge.js" nonce="17779603389840.2908730088826338"></script> <script type="text/javascript" nonce="17779603389840.2908730088826338"> const maxLocationLength = 2047 - "&chal_t=1760623098515&force_referer=".length; function searchStringWithNewParam(search, key, value) { value = encodeURIComponent(value); if (!search.startsWith('?')) { return search + `?${key}=${value}`; } else if (search.endsWith('&')) { return search + `${key}=${value}`; } else { return search + `&${key}=${value}`; } } function getNewUrlWithAddedParameter(location, parameters) { let newSearch = location.search; for (let parameterName of Object.keys(parameters)) { if (!newSearch.includes(`${parameterName}=`)) { newSearch = searchStringWithNewParam(newSearch, parameterName, parameters[parameterName]); } } let newHref = `${location.pathname}${newSearch}${location.hash}`; if (newHref.length < maxLocationLength) { return newHref; } return null; } </script> </head> <body> <div id="challenge-container"></div> <script type="text/javascript" nonce="17779603389840.2908730088826338"> let newHref; try { setTimeout(() => { try { reportChallengeError("Reloaded without updating url", new Error("")); } catch (e) {} document.location.reload(); }, 20000); let referrer = document.referrer; let availableLength = maxLocationLength - document.location.href.length; if (encodeURIComponent(referrer).length > availableLength) { let parsedReferrer = new URL(referrer); referrer = parsedReferrer.origin; if (encodeURIComponent(referrer + parsedReferrer.pathname).length < availableLength) { referrer = referrer + parsedReferrer.pathname; } } let parameters = { chal_t: 1777960338984, force_referer: referrer, }; newHref = getNewUrlWithAddedParameter(document.location, parameters); } catch (e) { reportChallengeError("Failed while getting new href", e); } newHref = newHref || document.location.href; AwsWafIntegration.saveReferrer(); AwsWafIntegration.checkForceRefresh().then((forceRefresh) => { if (forceRefresh) { AwsWafIntegration.forceRefreshToken().then(() => { window.location.href = newHref; }); } else { AwsWafIntegration.getToken().then(() => { window.location.href = newHref; }); } }); </script> <noscript> <h1>JavaScript is disabled</h1> In order to continue, we need to verify that you're not a robot.0<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title></title> <style> body { font-family: "Arial"; } </style> <script type="text/javascript" nonce="17779701756860.048560879885087616"> function getAjaxObject() { var ajax; if (window.XMLHttpRequest) { try { ajax = new window.XMLHttpRequest(); // XMLHttpRequest (Mozilla, Opera, Safari, etc.) } catch (e) { return false; } } else { var msXML = new Array( // XMLHttpRequest (IE with ActiveX) "Msxml2.XMLHTTP.5.0", "Msxml2.XMLHTTP.4.0", "Msxml2.XMLHTTP.3.0", "Msxml2.XMLHTTP", "Microsoft.XMLHTTP" ); for (var i = 0; i < msXML.length; i++) { // We want to get the best we can try { ajax = new ActiveXObject(msXML[i]); break; } catch (e) { return false; } } } return ajax; } function sendAjaxRequest(url, data, callback) { const xhr = getAjaxObject(); if (!xhr) { callback(new Error('Unable to create XMLHttpRequest object'), null); return; } xhr.open('POST', url, true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.setRequestHeader('Accept', 'application/json'); xhr.onreadystatechange = function() { if (xhr.readyState === 4) { if (xhr.status >= 200 && xhr.status < 300) { try { const response = JSON.parse(xhr.responseText); callback(null, response); } catch (error) { callback(error, null); } } else { callback(new Error('HTTP error! status: ' + xhr.status), null); } } }; xhr.onerror = function() { callback(new Error('Network error'), null); }; xhr.send(JSON.stringify(data)); } function reportChallengeError(log, challengeError) { try { sendAjaxRequest( 'https://reports.booking.com/chal_report', { log: log, message: challengeError.message, stack: challengeError.stack }, (e, response) => { if (e) { console.error('Request failed:', e); } else { console.log('Success:', response); } } ); } catch (e) {} } function setupErrorHandling() { // Handle JavaScript errors window.addEventListener('error', function(event) { var error = { message: event.message, stack: event.error ? event.error.stack : '' }; reportChallengeError('javascript_error', error); }); // Handle unhandled promise rejections window.addEventListener('unhandledrejection', function(event) { var error = { message: event.reason && event.reason.message ? event.reason.message : 'Unhandled Promise Rejection', stack: event.reason && event.reason.stack ? event.reason.stack : '' }; reportChallengeError('promise_rejection', error); }); } // Initialize error handling setupErrorHandling(); </script> <script type="text/javascript" nonce="17779701756860.048560879885087616"> window.awsWafCookieDomainList = ['booking.com']; </script> <script type="text/javascript" src="https://www.booking.com/__challenge_h78IRKX3kpQxScCExxShBNwRUlb/d8c14d4960ca/a18a4859af9c/challenge.js" nonce="17779701756860.048560879885087616"></script> <script type="text/javascript" nonce="17779701756860.048560879885087616"> const maxLocationLength = 2047 - "&chal_t=1760623098515&force_referer=".length; function searchStringWithNewParam(search, key, value) { value = encodeURIComponent(value); if (!search.startsWith('?')) { return search + `?${key}=${value}`; } else if (search.endsWith('&')) { return search + `${key}=${value}`; } else { return search + `&${key}=${value}`; } } function getNewUrlWithAddedParameter(location, parameters) { let newSearch = location.search; for (let parameterName of Object.keys(parameters)) { if (!newSearch.includes(`${parameterName}=`)) { newSearch = searchStringWithNewParam(newSearch, parameterName, parameters[parameterName]); } } let newHref = `${location.pathname}${newSearch}${location.hash}`; if (newHref.length < maxLocationLength) { return newHref; } return null; } </script> </head> <body> <div id="challenge-container"></div> <script type="text/javascript" nonce="17779701756860.048560879885087616"> let newHref; try { setTimeout(() => { try { reportChallengeError("Reloaded without updating url", new Error("")); } catch (e) {} document.location.reload(); }, 20000); let referrer = document.referrer; let availableLength = maxLocationLength - document.location.href.length; if (encodeURIComponent(referrer).length > availableLength) { let parsedReferrer = new URL(referrer); referrer = parsedReferrer.origin; if (encodeURIComponent(referrer + parsedReferrer.pathname).length < availableLength) { referrer = referrer + parsedReferrer.pathname; } } let parameters = { chal_t: 1777970175686, force_referer: referrer, }; newHref = getNewUrlWithAddedParameter(document.location, parameters); } catch (e) { reportChallengeError("Failed while getting new href", e); } newHref = newHref || document.location.href; AwsWafIntegration.saveReferrer(); AwsWafIntegration.checkForceRefresh().then((forceRefresh) => { if (forceRefresh) { AwsWafIntegration.forceRefreshToken().then(() => { window.location.href = newHref; }); } else { AwsWafIntegration.getToken().then(() => { window.location.href = newHref; }); } }); </script> <noscript> <h1>JavaScript is disabled</h1> In order to continue, we need to verify that you're not a robot.
Stay ahead of the changes

Watch this before it changes again

Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.