8 Total
2 High severity
5 Medium severity
1 Low severity
Summary

This is Booking.com's Terms of Service — the legal agreement you accept when you use their website or app to search for and book hotels, flights, attractions, or rental cars. The most important thing to know is that Booking.com acts only as a middleman: if your hotel or rental is unsatisfactory, Booking.com explicitly disclaims responsibility, meaning your dispute is with the property or supplier, not Booking.com. Before making a booking, always read the individual property's cancellation and refund policy, since Booking.com's terms make the property — not Booking.com — responsible for delivering what you paid for.

Technical Summary

This document constitutes Booking.com's Terms of Service governing the contractual relationship between Booking.com B.V. (Amsterdam) and users accessing its online travel agency platform, operating as an intermediary between travelers and accommodation, transport, and attraction providers. The most significant obligations include users' agreement to accurate information submission, prohibition on commercial exploitation of platform content, and Booking.com's explicit disclaimer of liability for the quality, fitness, and accuracy of third-party service provider listings. Notably, the document positions Booking.com strictly as an intermediary ('platform'), explicitly disclaiming responsibility for third-party service failures, force majeure events, and system outages, while simultaneously reserving broad rights to modify, suspend, or terminate user access without prior notice — a combination that creates asymmetric risk allocation heavily favoring the company. The document engages GDPR (as a Netherlands-headquartered entity processing EU personal data), the EU Consumer Rights Directive, the UK Consumer Rights Act 2015, and relevant e-commerce regulations across multiple jurisdictions; compliance teams should note that the intermediary liability framing may be tested under the EU Digital Services Act (DSA) and that the broad intellectual property assignment clause for user-submitted content warrants scrutiny under GDPR Article 6 lawful basis requirements.

Evidence Provenance
Captured April 29, 2026 06:32 UTC
Document ID CA-D-000237
Version ID CA-V-001006
Wayback Machine View archived versions →
SHA-256 37a3b1d12c09471659f63f172c688cdf9db41e521bbcca4c1257a7f936bd9950
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Institutional Analysis

🔒 Institutional analysis locked

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Upgrade to Professional — $149/mo
Change Timeline
View full version history (0 captures) →
Analyzed Changes

10 changes analyzed since monitoring began.

What changed Booking.com updated their Booking.com Terms and Conditions on April 29, 2026. Change detected: 1 sentence(s) modified. Document contained 1572 sentences after update.
Consumer impact Booking.com removed the 'Don't sell or share my personal information' link from the footer of their Terms and Conditions page, making it harder for users — especially California residents — to find and exercise their opt-out rights under state privacy law. While the right itself may still exist elsewhere on the platform, reducing its visibility undermines practical access to the control. You can search for Booking.com's Privacy Notice directly and look for an opt-out mechanism or contact their customer service to exercise your CCPA opt-out right.
Why it matters California residents have a legal right to opt out of the sale or sharing of their personal information, and this link was a key mechanism for exercising that right. Its removal reduces the visibility and accessibility of a legally mandated privacy control.
What changed Booking.com updated their Booking.com Terms and Conditions on April 23, 2026. Change detected: 1569 sentence(s) added, 3 sentence(s) modified. Document contained 1572 sentences after update.
Consumer impact Booking.com has introduced a mandatory arbitration clause in Section A20 that requires most disputes to be resolved through binding arbitration rather than in a court of law. This also includes a waiver of your right to participate in class action lawsuits and jury trials, significantly limiting your legal options if something goes wrong with a booking. You can opt out of the arbitration agreement within 30 days of being subject to the new terms by following the opt-out procedure described in Section A20.
Why it matters The mandatory arbitration clause with class action waiver significantly limits users' ability to hold Booking.com accountable through the courts, particularly for widespread consumer harm where class actions are the most effective remedy. US users especially need to be aware of the 30-day opt-out window to preserve their litigation rights.
What changed Booking.com updated their Booking.com Terms and Conditions on April 19, 2026. Change detected: 195 sentence(s) added, 158 sentence(s) removed, 287 sentence(s) modified. Document contained 1571 sentences after update.
Consumer impact Booking.com has added a mandatory arbitration clause (section A20) that removes your right to sue the company in court or join a class action lawsuit, resolving disputes instead through private binding arbitration. This significantly limits your legal options if something goes wrong with a booking. You can opt out of the arbitration agreement by following the opt-out process described in section A20 within 30 days of April 19, 2026.
Why it matters The addition of mandatory arbitration and a class action waiver fundamentally changes how consumers can seek legal recourse against Booking.com, shifting disputes out of courts and into private arbitration. Users who do not opt out within 30 days permanently lose the right to sue in court or join group lawsuits.
What changed Booking.com updated their Booking.com Terms and Conditions on April 18, 2026. Change detected: 1531 sentence(s) added, 3 sentence(s) modified. Document contained 1534 sentences after update.
Consumer impact Booking.com's Terms of Service page now displays the actual legal terms instead of a security challenge page, meaning consumers can now read and understand the rules governing their bookings. The terms clarify that three documents form the full contract: the Terms of Service, the How We Work page, and the Content Standards and Guidelines. Section A16 is specifically identified as the place to look if something goes wrong with a travel booking.
Why it matters Booking.com's full Terms of Service are now accessible after a period where the page returned only a bot-check screen, meaning users can finally read the legal terms governing their travel bookings. The terms bind users to three separate documents, so consumers should review all three before making reservations.
What changed Booking.com updated their Booking.com Terms and Conditions on April 14, 2026. Change detected: 1 sentence(s) modified. Document contained 3 sentences after update.
Consumer impact The detected change is a routine technical update to Booking.com's AWS WAF (Web Application Firewall) bot-detection challenge script, specifically a nonce and timestamp value rotation. This is an internal infrastructure change and does not alter any consumer-facing terms, rights, data practices, or obligations. No action is required by consumers.
Why it matters This change does not matter to consumers as it is a purely technical security infrastructure update. No rights, obligations, or data practices were changed.
What changed Booking.com updated their Booking.com Terms and Conditions on April 11, 2026. Change detected: 1 sentence(s) modified. Document contained 3 sentences after update.
Consumer impact The change detected in Booking.com's Terms and Conditions on April 11, 2026 appears to be a routine update to internal security challenge tokens used by AWS WAF bot-protection infrastructure, not a modification to the substantive terms consumers are bound by. No consumer-facing rights, obligations, or data practices appear to have been altered based on the available diff. There is no specific action consumers need to take as a result of this change.
Why it matters While this specific detected change has no material impact on consumers, the bot-challenge gating means the actual Terms and Conditions content could not be verified, leaving open the possibility that a substantive change occurred and was not captured. Organizations relying on automated monitoring should be aware of this visibility gap.
What changed Booking.com updated their Booking.com Terms and Conditions on April 09, 2026. Change detected: 1 sentence(s) modified. Document contained 3 sentences after update.
Consumer impact The detected change in Booking.com's Terms and Conditions document appears to be a routine update to internal security infrastructure timestamps, not a substantive policy revision. No consumer rights, data practices, fees, or obligations appear to have changed as a result. Consumers do not need to take any action in response to this update.
Why it matters This change does not appear to affect consumer rights or Booking.com's actual Terms and Conditions. The detection was likely triggered by a security infrastructure refresh rather than a genuine policy update.
What changed Booking.com updated their Booking.com Terms and Conditions on April 07, 2026. Change detected: 1 sentence(s) modified. Document contained 3 sentences after update.
Consumer impact The detected change on April 7, 2026 is not a substantive update to Booking.com's Terms and Conditions for consumers. It reflects an automated rotation of security challenge tokens used by AWS WAF (Web Application Firewall) to protect the page from bots. No consumer rights, obligations, or data practices were modified by this change.
Why it matters This change does not materially affect consumers — it is a routine security token rotation. However, the fact that the actual Terms and Conditions content was inaccessible at capture time means any real policy changes may have gone undetected.
What changed Booking.com updated their Booking.com Terms and Conditions on April 03, 2026. Change detected: 1 sentence(s) modified. Document contained 3 sentences after update.
Consumer impact The detected change in Booking.com's Terms and Conditions is a technical update to security challenge tokens used by their bot-detection infrastructure (AWS WAF), not a modification to any consumer-facing policy language. This does not affect consumer rights, data handling, fees, or any contractual obligations. No consumer action is required or warranted.
Why it matters This change does not materially affect any consumer. It is a routine backend security token update with no impact on rights, data, fees, or terms.
What changed Booking.com updated their Booking.com Terms and Conditions on April 02, 2026. Change detected: 1 sentence(s) modified. Document contained 3 sentences after update.
Consumer impact The detected change in Booking.com's Terms and Conditions document on April 2, 2026, is limited to an internal security challenge timestamp update used by AWS WAF bot-detection infrastructure. No consumer-facing rights, obligations, data practices, or contractual terms were altered. There is no action consumers need to take as a result of this change.
Why it matters Although a change was flagged in Booking.com's Terms and Conditions, it appears to be a technical security infrastructure update rather than a substantive policy change, meaning consumers' rights and obligations under the platform remain unaffected. However, because the actual T&C content may have been obscured by the bot-challenge page, independent verification is advisable.

Recent Clause-Level Changes Apr 29, 2026

8 provisions unchanged.

View full change record →
High Severity — 2 provisions
Medium Severity — 5 provisions
Low Severity — 1 provision

Cross-platform context

See how other platforms handle Cookie and Tracking Consent Framework and similar clauses.

Compare across platforms →

Applicable Regulations

CCPA/CPRA
California, USA
CFAA
United States Federal
CAN-SPAM
United States Federal
DSA
European Union
GDPR
European Union
TCPA
United States Federal
UK GDPR
United Kingdom