Data Report Card · Booking.com
Booking.com Data Report Card
Travel / OTA · Booking Holdings Inc.
Data
Practices
Practices
2Access1Portability1Friction2Deletion0Sells1Trains AI
=
C
7/12
Agent
Readiness
Readiness
2Access
1Portability
0API access
=
C
3/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from Booking.com's published policy; none has been tested (run by us) yet.
2Accessstated
Booking.com provides a Data Subject Request form (Data Subject Request for Booking.com Customers) and states a right of access and a right to obtain a copy of your personal data.
Booking.com — Privacy Statement (your rights) / DSAR form · accessed Jun 2026 ↗1Portabilitystated
Access returns a copy of your data, but Booking.com does not document multiple confirmed structured machine-readable export formats for a self-serve portable download, so portability is scored at the single-format level.
Booking.com — Privacy Statement (right to obtain a copy) · accessed Jun 2026 ↗1Frictionstated
Rights are exercised through a DSAR form rather than a one-click in-product control, placing friction at the moderate level.
Booking.com — DSAR form (Data Subject Request for Customers) · accessed Jun 2026 ↗2Deletionstated
Booking.com supports account deletion in-app (Booking.com app account settings) and erasure through a DSAR request, removing your personal data subject to legal-retention exceptions.
Booking.com — Privacy Statement (right to erasure) · accessed Jun 2026 ↗0Sells / sharesstated
Booking.com states "we do not sell or rent your personal data" but admits that sharing identifiers such as a hashed email or phone with advertising partners "may be considered the sale of personal data" under US state laws, and offers a sale / targeted-advertising / profiling opt-out on its DSAR Preferences tab; this ad-partner sharing keeps it at the lowest level.
Booking.com — Privacy Statement (advertising and US state opt-out) · accessed Jun 2026 ↗1Trains AIstated
Booking.com uses customer behavior, transactions, and preferences for internal machine learning and personalization and states it shares only aggregated or de-identified data with third parties, so model-training use of personal data is scored at the partial level.
Booking.com — Privacy Statement (automated processing and personalization) · accessed Jun 2026 ↗0API access — feeds Agent Readiness, not the /12stated
Booking.com offers partner and affiliate APIs for property and travel partners, but there is no consumer-grantable OAuth API for an agent to fetch your own personal account data; the self-data path is the manual DSAR form, so agent access is scored at the lowest level.
Booking.com — Connectivity / Demand API (partner-facing) · accessed Jun 2026 ↗Reviewed Jun 2026. Booking.com's privacy notice and DSAR form returned 403 to automated fetches; the data-rights mechanics were corroborated through the Booking Holdings privacy notice and named third-party write-ups. Booking.com's own admission that ad-partner sharing "may be considered the sale of personal data" is the load-bearing cell.
How to request your data from Booking.com
- Go to https://www.booking.com/content/privacy.html — Booking.com's data-request entry point.
- Data Subject Request form (Data Subject Request for Booking.com Customers); in-app account deletion; opt-out on the DSAR Preferences tab.
- Expected wait: DSAR form for access / erasure / opt-out; in-app account deletion via the Booking.com app — Booking.com's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Booking.com — Data Subject Requests: https://www.booking.com/content/privacy.html.
These steps reflect Booking.com's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.