Booking.com Under EU Investigation, Airbnb Limits Guest Data: What Changes for Hosts in Cyprus and Greece

Most regulatory news in our sector arrives slowly: a consultation, a draft, a vote a year later. October was different. Several stories that BnBNews, the Greek short-stay trade site, carried in the last week of the month point in the same direction. The rules are increasingly being written for the platforms, and the platforms are passing them on to hosts.

None of it is a ban. All of it changes how a well-run operation in Larnaca, Paphos, Athens or Thessaloniki should handle guest data, distribution and compliance in the months ahead.

1. Booking.com: a formal DSA investigation

On 21 October 2026 the European Commission opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act (DSA). Its concern is that the platform may not have diligently assessed or effectively mitigated the risks from fraudulent listings and phishing scams (European Commission). The investigation covers three areas:

• Fraudulent and non-compliant listings, including properties that do not exist.
• Phishing that exploits Booking.com's reservation and guest data.
• Paid-for ranking: listings whose providers paid for a higher position in search results, and whether these are clearly identifiable as advertising.

Booking.com has been designated a "very large online platform" under the DSA since 25 April 2023. Before opening proceedings the Commission reviewed its risk assessments, its transparency reports and its replies to formal requests for information (LHR Law). If an infringement is eventually found, the DSA allows fines of up to 6% of worldwide annual turnover. Interim measures or binding commitments are also possible routes. No breach has been established. Booking.com says it is cooperating constructively with the Commission (BnBNews).

Why it matters to hosts. Two of the three areas touch operators directly. Phishing that impersonates a property, or the platform, damages the property's reputation even when the property did nothing wrong. And the paid-ranking question concerns the programmes in which accommodation providers pay a higher commission for better placement. The obligation under investigation is Booking.com's, not the host's. But if the outcome is clearer "advertising" labels on boosted listings, the value of paying for that visibility could change. Anyone whose revenue plan relies on it should watch this case.

2. Airbnb: new limits on guest data from 20 November

Airbnb's updated policy on host requirements applies to reservations booked on or after 20 November 2026 (Airbnb Help Centre). In summary:

The exception that matters most in our markets is legal compliance. Where the law requires guest data, hosts may collect it. But they must disclose what is required and why in the listing's requests section before booking, collect no more than the law requires, store and dispose of it securely, and be ready to show evidence if Airbnb asks. Breaches can lead to warnings, listing suspension or removal, and account removal for repeat offences.

Greece. Hosts need guest details to file the AADE short-term stay declaration. The AADE user manual asks for the tenant's tax number (AFM) if Greek, or full name and passport number if foreign. It does not ask for a photo or copy of the passport (AADE manual, p. 22). That manual dates from 2018, so confirm current practice with your accountant. As BnBNews points out, the tax obligation does not automatically cover collecting data, such as emails, for marketing (BnBNews).

Cyprus. The same principle applies under Airbnb's policy. Collect only what a Cypriot legal obligation actually requires, name it in the listing, and keep marketing consent separate. Confirm with your adviser which obligations apply to your property before 20 November, not after a guest complaint.

A side effect worth naming: with fewer contact details changing hands, more of the guest relationship stays inside Airbnb. That makes a direct-booking channel, built on guests who choose to come back, more valuable, not less.

3. Spain: 8,318 listings flagged in one request

On 23 October 2026 Spain's consumer affairs ministry asked two platforms, which it did not name, to remove 8,318 listings. The listings were advertised as seasonal rentals but allowed stays of under 31 days. Of these, 6,772 are in the Madrid region, and 6,523 in the city of Madrid itself. The requests were sent through the DSA's notice mechanism. Once notified, a platform is directly responsible for acting. The ministry treats them as misleading advertising under Spanish consumer law, because seasonal lets must now exceed 31 days under the reformed tenancy rules, which Royal Decree-law 29/2026 amended. The decree was awaiting parliamentary validation, expected on 12 November (Infobae).

It follows earlier enforcement. Spain fined Airbnb €64 million in December 2025 over unlicensed listings and listings with false registration numbers, which led to more than 65,000 removals. Madrid's regional High Court (TSJ) upheld the fine in March 2026. Booking.com separately removed more than 4,000 non-compliant listings after a similar request.

The lesson for Cyprus and Greece is not about Spanish seasonal-let law. It is the method. An authority with listing data sends one notice per platform, and the platform does the removing. Under EU Regulation 2024/1028, which has applied since 20 May 2026, platforms must display registration numbers, carry out random checks on them, and share activity data with national authorities (European Commission). We covered what that means for the Cyprus register in our August analysis. Spain shows how quickly that data becomes action.

4. The EU Affordable Housing Act: rules for the rule-makers

On 9 September 2026 the Commission proposed an Affordable Housing Act. It is a draft Regulation, so it is not yet law and Parliament and Council can amend it. It does not ban short-term rentals or cap nights. Instead, it sets the conditions a public authority would have to meet before restricting short-term rentals on housing-affordability grounds (Rental Scale-Up):

• Housing stress in the area, measured by a price-to-income threshold and a trend test.
• A significant adverse effect from short-term rentals on housing availability or affordability over at least the previous three years.
• No less restrictive measure would work, and the measure is targeted at the stressed area.

Measures would last no more than five years, renewable only after review. Restrictions adopted purely on housing grounds would not apply to a host's primary residence. Transitional arrangements would be mandatory for existing lawful operations. And an authority must already be applying Regulation 2024/1028 in an area before restricting there. The draft would also drop the duty to notify the Commission of such measures in advance, and would leave measures adopted before it takes effect outside its tests.

The European Holiday Home Association (EHHA) has pushed back on those two points in particular (BnBNews). In its September response it calls the Act premature, because reliable EU-wide data under the new regulation does not exist yet. It also cites short-term rentals as about 1.2% of conventional EU dwellings, against roughly 20% of dwellings standing vacant (EHHA). Those are an industry body's figures and should be read as such. But the core point, that restrictions should follow evidence rather than precede it, is one we would endorse for Cyprus and Greece alike.

Meanwhile, demand is not the problem

None of this is happening in a weak market. The latest Greek figures, as reported by BnBNews from Bank of Greece and Hosthub data, show growth led by price rather than occupancy (BnBNews):

Occupancy and rate figures are from a private sample of properties on one platform, not an official census.

When growth comes from rate rather than occupancy, guest trust and listing quality matter more. Those are exactly what the Booking.com and Airbnb changes touch.

What this means for operators in Cyprus and Greece

1. Audit your guest-data flow before 20 November. List every field your pre-arrival form, check-in app and PMS ask for. For each one, name the legal obligation behind it or remove it. Move the remaining requirements into the Airbnb listing's requests section, with the reason.
2. Stop keeping ID copies by default. Check ID in person if you disclose it. Keep a copy only where a legal obligation requires it, and store and delete it securely.
3. Give keyless properties a fallback. If entry depends on an app that needs an account, have a code or key-box alternative ready for guests who ask.
4. Separate compliance from marketing. Tax and registration data is one thing. Newsletter consent is another, and should be optional.
5. Harden guest communications against phishing. Tell guests at booking that you will never ask for card details or payment by message or link outside the platform's own payment flow, and make sure your team never does.
6. Check your registration number everywhere. Every listing, on every channel, should show a number that matches the official register. Increasingly, enforcement starts with that match.
7. Re-test the economics of paid visibility. If you pay extra commission for placement, measure what it actually adds. Meanwhile, keep building the direct channel; our direct bookings playbook sets out a 90-day plan.
8. Greek hosts: September declarations are due 13 November. AADE extended the deadline for short-stay declarations covering September 2026 departures and cancellations from 20 October to 13 November, by decision A.1227/2026 (BnBNews).

The common thread is simple. Platforms are becoming the enforcement layer for European short-term rental rules, and they will pass that pressure to hosts quickly. Operators who are already compliant, transparent about what they collect and why, and less dependent on any single channel will notice these changes least. The Cyprus Short Term Rental Association's position has been consistent: sensible regulation, applied evenly to everyone. The next few months will test whether the platforms can deliver that.

Frequently asked questions

Has Booking.com been found to have broken EU law?

No. On 21 October 2026 the European Commission opened formal proceedings under the Digital Services Act. That is the start of an investigation, not a finding. If an infringement were established, fines of up to 6% of worldwide annual turnover are possible.

From when does Airbnb's new guest-data policy apply?

To reservations booked on or after 20 November 2026. Bookings made before that date remain under the previous off-platform policy.

Can I still ask Airbnb guests for a passport number in Greece?

Where the law requires it, yes, as long as you disclose the requirement and the reason in the listing before booking and collect no more than the law requires. For the AADE short-stay declaration, the manual asks for a foreign tenant's full name and passport number, not a copy of the passport. Confirm current requirements with your accountant.

Will the EU Affordable Housing Act ban short-term rentals in Cyprus or Greece?

No. It is a proposal, not yet law, and it does not ban short-term rentals. It sets the evidence and proportionality tests an authority would have to meet before restricting them on housing grounds.

Are keyless-entry apps still allowed on Airbnb?

Yes. But guests cannot be required to download an app or register on another site to get in, so hosts must offer an alternative access method on request.