Version history

The change appears to be a technical update to Booking.com's WAF (Web Application Firewall) challenge page, updating nonce values and a timestamp parameter. The before and after versions are HTML/JavaScript security challenge pages with no substantive changes to stated privacy policies or data practices. This is not a privacy policy change but rather a technical infrastructure update to the challenge mechanism users encounter when accessing Booking.com.

Booking.com removed a dedicated privacy section that previously explained how it and its insurance partners handle personal data when you purchase insurance products through the platform. The section previously clarified that both Booking.com and the insurer are jointly responsible for how your data is used, and encouraged you to review the insurer's privacy notice. This section is no longer in the updated privacy statement as of May 5, 2026.

Booking.com reorganized its privacy notice to separate California residents' data rights from the general US privacy section. The updated section now explicitly lists the 10 categories of personal information California law recognizes, clarifies what counts as a 'sale' of data under California law, and adds three new consumer rights: the ability to opt out of data sales, opt out of cross-context behavioral advertising, and limit use of sensitive personal information. These changes reflect California's privacy law requirements and give California residents more granular control over how their data is used.

Booking.com's privacy policy has been reorganized to separate US (non-California) residents from California residents, with California-specific protections removed and replaced with broader US state privacy language. New sections have been added describing data sharing related to a co-branded credit card product with Imprint Payments, Inc. Key consumer rights such as the ability to limit use of sensitive personal information have been removed from the policy.

Booking.com replaced a technical security challenge page with a substantially expanded privacy notice on April 19, 2026. The new document added approximately 516 sentences of privacy policy content covering data collection, processing purposes, user rights, cookie usage, AI decision-making, and data protection practices. This represents a comprehensive rewrite or major expansion of Booking.com's privacy disclosure to travelers.

The detected change involves technical updates to Booking.com's challenge verification system (likely a bot detection or security mechanism), not substantive changes to their Privacy Statement. The HTML security tokens and timestamps were updated, but the core privacy policy language and consumer rights remain unchanged. This is a routine security maintenance update with no material impact on what data Booking.com collects, uses, or how it protects user information.