data report card

Data Report Card · Booking.com

Booking.com Data Report Card

Travel / OTA · Booking Holdings Inc.
Data
Practices
2Access1Portability1Friction1Deletion1Sells1Trains AI
=
C
7/12
Agent
Readiness
2Access 1Portability 0API access
=
C
3/6

Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?

Help me make a request →
Reviewed Jun 2026  ·  some cells re-verified Aug 2026 · policies are checked weekly for changes  ·  stated — every cell is read from Booking.com's published policy; none has been tested (run by us) yet.
2Accessstated
Booking.com provides a Data Subject Request form (Data Subject Request for Booking.com Customers) and states a right of access and a right to obtain a copy of your personal data.
Booking.com — Privacy Statement (your rights) / DSAR form · accessed Aug 2026 ↗
1Portabilitystated
Request-only portability: "In certain situations, you can also ask us to provide you with specific personal data you have given us for possible transmission to a third party." No export tool is documented.
Booking.com Privacy Notice — Your rights · accessed Aug 2026 ↗
1Frictionstated
Rights are exercised through a DSAR form rather than a one-click in-product control, placing friction at the moderate level.
Booking.com — DSAR form (Data Subject Request for Customers) · accessed Aug 2026 ↗
1Deletionstated
Erasure runs through the rights path ("If you exercise your right of erasure of your Booking.com account…"); retention is "for as long as is necessary" with no stated post-deletion purge timeline, which caps the cell below 2. Self-serve deletion exists for AI memories within that feature.
Booking.com Privacy Notice — retention / Your rights · accessed Aug 2026 ↗
1Sells / sharesstated
The notice states Booking.com shares "certain elements of your personal data with third parties, which under US state privacy laws may be considered the sale of personal data", including inferences and analytics — and lists stated opt-out rights ("Opt out of the selling of data", "Opt out of targeted advertising", "Opt out of profiling") via the Your rights path. The prior "we do not sell or rent your personal data" claim no longer appears. Admission plus a working, findable opt-out.
Booking.com Privacy Notice — US state rights · accessed Aug 2026 ↗
1Trains AIstated
"Training & optimizing AI models — We may use your personal data to develop and enhance our machine learning models and artificial intelligence systems." An objection path is stated where no direct opt-out control exists in account settings.
Booking.com Privacy Notice — Training & optimizing AI models · accessed Aug 2026 ↗
0API access — feeds Agent Readiness, not the /12stated
Booking.com offers partner and affiliate APIs for property and travel partners, but there is no consumer-grantable OAuth API for an agent to fetch your own personal account data; the self-data path is the manual DSAR form, so agent access is scored at the lowest level.
Booking.com — Connectivity / Demand API (partner-facing) · accessed Jun 2026 ↗
Reviewed Jun 2026. Booking.com's privacy notice and DSAR form returned 403 to automated fetches; the data-rights mechanics were corroborated through the Booking Holdings privacy notice and named third-party write-ups. Booking.com's own admission that ad-partner sharing "may be considered the sale of personal data" is the load-bearing cell.

Events

Breaches, policy changes, and export-format changes we’ve recorded at Booking.com — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →

19 Aug 2026Booking.com replaced its California-only privacy rights section with one covering all US residents, and now states it derives your location from your IP address.policy change
On the events page →

Grade history

Every change to this company’s grade since it was first published, and why. All grade changes →

31 Aug 2026Sells / shares your data0→1score

The August 2026 revision removed the contradictory "we do not sell or rent your personal data" claim. The notice now plainly admits sharing that "may be considered the sale of personal data" (including inferences and analytics) and lists stated opt-out rights for selling, targeted advertising and profiling. An honest admission with a working, findable opt-out scores the moderate rung under rule 3; the prior 0 rested on the claim-plus-contradiction shape.

31 Aug 2026Deletion2→1score

Full read of the August 2026 revision found no stated post-deletion purge timeline and no in-app deletion path in the notice; erasure is a request-based right. A stated timeline is the distinction that earns a 2 (R2, Notion precedent), so the cell moves to 1.

How to request your data from Booking.com

  1. Go to https://www.booking.com/content/privacy.html — Booking.com's data-request entry point.
  2. Data Subject Request form (Data Subject Request for Booking.com Customers); in-app account deletion; opt-out on the DSAR Preferences tab.
  3. Expected wait: DSAR form for access / erasure / opt-out; in-app account deletion via the Booking.com app — Booking.com's stated turnaround (we haven't independently timed a request yet).
  4. No self-serve option, or want a formal request? Contact Booking.com — Data Subject Requests: https://www.booking.com/content/privacy.html.

These steps reflect Booking.com's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.

Help me make a request →