Does Booking.com track my location?

Yes, Booking.com may collect your current mobile location when you grant permission to provide nearby suggestions and personalised options.

What personal data does Booking.com collect about me?

Booking.com collects account, reservation, payment, ID documents, device identifiers, IP address, browsing activity, searches, reviews, and communications.

How does Booking.com use my data for advertising and personalization?

They use cookies, behavioural data, and partner information to personalise search results and deliver targeted ads across websites and apps.

Who does Booking.com share my data with?

Booking.com shares data with trip providers, Booking.com group companies, payment processors (e.g., Adyen, Stripe), analytics vendors, insurers, and legal authorities.

How long does Booking.com retain my data after I delete my account?

Retention is described as 'as long as necessary' for purposes with some specific timelines (e.g., call recordings ~30 days), so periods vary.

Does Booking.com build profiles or use my data for profiling?

Yes, they perform behavioural profiling, personalization and ranking and may combine data across sessions and devices for analytics and recommendations.

Which tracking technologies does Booking.com explicitly use?

Booking.com explicitly uses cookies classified as functional, analytical, marketing, and social media cookies across websites, emails, and apps.

How can I opt out of personalised ads and data processing on Booking.com?

Use cookie preferences, withdraw consent for AI memories, or contact the privacy team via the Data Subject Request form to exercise opt-outs.

What is the process for deleting or exporting my Booking.com data?

You can request access, export, correction, or deletion through the Data Subject Request form or by contacting the privacy team by email or mail.

Does Booking.com transfer my data internationally and what safeguards apply?

Yes, cross-border transfers occur; Booking.com uses SCCs, Binding Corporate Rules, and other safeguards for transfers outside the EEA/UK.

What Data Does Booking Collect? Privacy Policy Breakdown

Quick Summary

What They Collect: Account, reservation, payment, ID, device, location, browsing, and communications data.
How They Use & Share It: To manage bookings, prevent fraud, personalize, advertise, train AI, and share with providers, group companies, and partners.
Your Rights: Access, correct, delete/export data via requests; manage cookie settings, AI memories, and withdraw consent where available.

Why You Should Care About Booking's Privacy Practices

Booking.com collects high-risk data types like government ID, payment details, location, and customer communications used across services and AI systems.
Broad data sharing with affiliates, trip providers, marketing partners, and payment processors enables cross-site profiling and targeted advertising.
AI training and automated call transcription can expose content to model training and extended retention, affecting privacy and potential bias.
Non-user data and business account address books mean third-party and employee contact details can be collected and processed.

Why High Exposure?

Policy permits extensive collection of contact, payment, ID documents, location, communications, images, and behavioural data for many purposes.

Booking.com shares personal data widely with affiliates, trip providers, marketing partners, analytics vendors, and payment processors.

The policy uses vague retention language ('as long as necessary') with only a few specific timelines, creating indefinite retention risk.

Behavioural profiling and cross-site personalised advertising are explicit, and personal data is used to train AI models and for targeted marketing.

Learn more about our methodology →

Privacy Highlights

What They Collect

Account information (name, email, username, password, account settings, Wallet, rewards)
Profile information (display name, avatar, verification badge, ID documents such as passport or national ID)
User content and files (reviews, uploaded photos, images, video, chat/email communications)
Payment information (credit card details, stored payment methods, Wallet payment data; integrations with Adyen and Stripe)
Identification/verification data (selfie, passport, national ID for verified accounts and flight/attraction bookings)
Demographic information (date of birth, travel-for-work flag, travel companions' names and dates of birth, preferences like dietary/accessibility)
Support data (customer service call metadata, transcripts, recordings; call detection and possible digital assistant transcripts)
Contact/address book data (Booking.com for Business address book and contact details provided for others)
Current location and geolocation (mobile device current location if granted)
Device & technical identifiers (IP address, device identifiers, OS, browser/app version, mobile device identifier, app crash logs)
Behavioral and usage data (searches, reservations, clicks, page views, browsing history, saved items, reviews, session dates/times)
Communications data (messages between traveler and trip providers, emails, chats)

How They Share Data

Business affiliates and subsidiaries (Booking.com group entities and Booking Holdings Inc. brands like Agoda, OpenTable)
Service providers (hosting, payments, customer support; explicitly Adyen and Stripe named for payments)
Trip providers and other travel partners (hotels, car rentals, attractions) who receive reservation details
Analytics and measurement partners (partners used for analytics, experiments, A/B testing and measurement)
Advertising and marketing partners (third-party marketing partners used for personalised ads and audience engagement)
Professional third parties (legal counsels, auditors) and insurers when relevant to disputes or claims
Competent authorities and law enforcement (disclosures for legal obligations, fraud investigations and regulatory requests)

Data Retention

Retention generally 'as long as necessary' for purposes; some specifics: call recordings ~30 days (30d default), insurance-related call recordings up to 12 months, Wallet/rewards rules up to 12 months; other data retention depends on purpose and legal obligations.

Your Rights

View, manage, and delete AI memories (privacy settings let you review and remove stored AI memories)
Withdraw consent for AI features and specific processing where consent applies (opt-out for AI memories)
Cookie preferences (ability to choose functional, analytical, and marketing cookie settings)
Unlink linked social accounts in account settings (manage connected social media accounts)
Exercise data subject rights via Data Subject Request form, email or mail (request access, correction, deletion, export)
Opt-out of certain targeted marketing where consent is required (contact privacy team if opt-out not directly available)
Request verification before fulfilling data requests (identity verification for data subject requests)
Manage saved items and reservations (account controls for saved trip items and reviews)
Limit personalization by deleting/withdrawing AI memories and adjusting account settings (controls for personalized features)

Detailed Analysis

Concerning Practices

Broad content license: uploads (reviews/photos) grant Booking.com worldwide commercial use unless you request removal
AI/ML processing and training: personal data may be used to train and improve machine learning and generative AI systems
Automated scanning/transcription: customer service calls may be transcribed, recorded, summarized and retained (AI summaries, 30-day default)
Behavioral profiling & targeted advertising: cookies and partner data used to build profiles and show personalised ads across sites/apps
International data transfers: data may be transferred and stored outside the EEA/UK with safeguards like SCCs and BCRs
Vague/indefinite retention language: policy frequently uses 'as long as necessary' without universal, fixed timelines (some exceptions named)
Non-user data collection: collects information about others (contact uploads, address book, public/social media sources)
Sharing contact identifiers with partners for ad linking: email/phone may be shared so partners can match it to other data for targeting
Account-owner/enterprise access: Booking.com for Business address book lets account owners manage others’ travel and contact details

Personal Data Types

Account information (name, email, username, password, account settings, Wallet, rewards) Profile information (display name, avatar, verification badge, ID documents such as passport or national ID) User content and files (reviews, uploaded photos, images, video, chat/email communications) Payment information (credit card details, stored payment methods, Wallet payment data; integrations with Adyen and Stripe) Identification/verification data (selfie, passport, national ID for verified accounts and flight/attraction bookings) Demographic information (date of birth, travel-for-work flag, travel companions' names and dates of birth, preferences like dietary/accessibility) Support data (customer service call metadata, transcripts, recordings; call detection and possible digital assistant transcripts) Contact/address book data (Booking.com for Business address book and contact details provided for others) Current location and geolocation (mobile device current location if granted) Device & technical identifiers (IP address, device identifiers, OS, browser/app version, mobile device identifier, app crash logs) Behavioral and usage data (searches, reservations, clicks, page views, browsing history, saved items, reviews, session dates/times) Communications data (messages between traveler and trip providers, emails, chats)

Tracking Methods

Cookies (collectively referred to as “cookies” including small tracking files used across website and apps) Functional cookies (remember preferences, sign-in, currency, language) Analytical cookies (used to analyse website and app usage and performance) Marketing cookies (used for personalised advertising and cross-site marketing) Social media cookies (used to enable sharing and social features, and cross-site social ads)

Third Parties

Business affiliates and subsidiaries (Booking.com group entities and Booking Holdings Inc. brands like Agoda, OpenTable) Service providers (hosting, payments, customer support; explicitly Adyen and Stripe named for payments) Trip providers and other travel partners (hotels, car rentals, attractions) who receive reservation details Analytics and measurement partners (partners used for analytics, experiments, A/B testing and measurement) Advertising and marketing partners (third-party marketing partners used for personalised ads and audience engagement) Professional third parties (legal counsels, auditors) and insurers when relevant to disputes or claims Competent authorities and law enforcement (disclosures for legal obligations, fraud investigations and regulatory requests)

User Controls

View, manage, and delete AI memories (privacy settings let you review and remove stored AI memories) Withdraw consent for AI features and specific processing where consent applies (opt-out for AI memories) Cookie preferences (ability to choose functional, analytical, and marketing cookie settings) Unlink linked social accounts in account settings (manage connected social media accounts) Exercise data subject rights via Data Subject Request form, email or mail (request access, correction, deletion, export) Opt-out of certain targeted marketing where consent is required (contact privacy team if opt-out not directly available) Request verification before fulfilling data requests (identity verification for data subject requests) Manage saved items and reservations (account controls for saved trip items and reviews) Limit personalization by deleting/withdrawing AI memories and adjusting account settings (controls for personalized features)

Booking Privacy Summary