Booking.com
- Your data trains their AI unless you opt out by form or email.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
They collect lots of travel and device data, use it for ads and AI, share it widely.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Bookings, passports, payments, location, device IDs, clicks, photos, and data from partners.
Read the exact line
Privacy policy
“When you make a trip reservation, we ask for your name and email address. Depending on the nature of the trip reservation, we may also ask for your home address, telephone number, payment information, date of birth, current location”
Training
They use it to book trips, personalize results, market to you, fight fraud, and train AI.
Read the exact line
Privacy policy
“We may use your personal data to develop and enhance our machine learning models and artificial intelligence systems.”
Sharing
Hotels, airlines, Booking Holdings brands, payment firms, and advertising partners can get data.
Read the exact line
Privacy policy
“We may share some of your personal data (such as identifiers) with advertising partners, as part of the marketing of our trip services through third parties”
Kept
Call recordings are kept about 30 days; overall how long they keep everything is not fully spelled out.
Read the exact line
Privacy policy
“If a call is recorded, it is kept for a limited amount of time (30 days by default) in order to fulfill the objectives mentioned earlier.”
Controls
Unsubscribe from marketing in emails or account settings; object to some AI use by contacting them.
Read the exact line
Privacy policy
“you can unsubscribe from receiving email marketing communications at any time by selecting the “Unsubscribe” link included in each communication, or you can manage your preferences via your account settings.”
Fine print
Must be 18; capped at booking cost.
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Turn off marketing emails
Unsubscribe link in emails or account settings
Adjust personalization / AI preferences
Account settings, Customization preferences
Object to AI training if no in-app switch
Contact them as described in the privacy notice Your rights section
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Your booking and browsing data can be used to train their AI unless you object.
Read the exact line
Privacy policy
“We may use your personal data to develop and enhance our machine learning models and artificial intelligence systems.”
For example, searches and past trips could help train ranking or chatbot models.
They send hashed IDs to ad companies so you can be shown travel ads elsewhere.
Read the exact line
Privacy policy
“We may share some of your personal data (such as identifiers) with advertising partners, as part of the marketing of our trip services through third parties”
For example, after looking at hotels you might see Booking ads on other sites.
Reviews and photos you upload can be used by them commercially worldwide, forever.
Read the exact line
Terms of service
“we’re allowed to use it on our Platform and for any other commercial purposes (including in a promotional context), everywhere, forever”
For example, your hotel photo could appear in ads even after you leave.
They can cancel trips and lock you out if they think you broke the rules.
Read the exact line
Terms of service
“We have the right to stop you from making any bookings, to cancel any bookings you’ve already made, and/or to stop you from using our Platform”
For example, a disputed review or alleged fraud could mean a canceled stay with no refund.
If something goes wrong on their side, they usually only owe you what you paid for that booking.
Read the exact line
Terms of service
“The most that we, or any Service Provider, will be for, whether for one event or a series of connected events, is the cost of your booking”
For example, a site outage that ruins a trip would not cover extra hotel or lost wages.
Staff can listen to or record some customer-service calls.
Read the exact line
Privacy policy
“we may have one or more authorized persons listen to the call or record the call for training and quality control purposes.”
For example, a call about a messy room might be recorded and reviewed later.
Optional verification can mean sending a passport photo and a selfie, which may go to a third party.
Read the exact line
Privacy policy
“If you want a verified account badge in those where it is available, we may ask for a copy of your identification (a passport or ID card) and a “selfie””
For example, to get a verified badge you might upload a selfie next to your ID.
You can turn off marketing emails in the message or in your account.
Read the exact line
Privacy policy
“you can unsubscribe from receiving email marketing communications at any time by selecting the “Unsubscribe” link included in each communication, or you can manage your preferences via your account settings.”
For example, click Unsubscribe in a Genius promo email.
Big privacy changes should be announced before they start.
Read the exact line
Privacy policy
“If Booking.com makes updates to a privacy notice that could significantly impact persons, it will take steps to inform these persons about such changes before they go into effect.”
For example, a new AI training use should be flagged before it applies to you.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- model training
- Using your content and conversations as examples to teach an AI system, which can then echo them in future answers. For example, a story you write in a chatbot may be studied by the company to make the next version of the bot.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- governing law
- Which country's or state's laws are used to settle any dispute, no matter where you live. For example, a user in Ohio may find the terms are judged under California law.
How we got here · grade F · score 27/100 · 15 of 15 policy answers backed by a verified quote · 3 not stated
What does the app collect beyond what it needs to work?
They collect booking details, passports, payments, optional location, device IDs, browsing, photos, and partner data, more than needed just to complete a reservation.
Does it record your voice, face or body, and what happens to that?
Optional ID plus selfie for a verification badge may be shared with a third party; some support calls are recorded for training and quality.
Are your chats and uploads used to train AI models, and is that off by default?
They may use personal data to train AI. If there is no in-app switch, you object by contacting them.
Can employees or contractors read your conversations, and when?
Some customer-service calls may be listened to or recorded for training and quality, with no opt-out described.
Are you profiled or tracked for advertising?
They run personalized marketing and share identifiers with advertising partners, plus cookies and similar trackers.
Do they sell or share your data, and can you opt out?
Data goes to trip providers, Booking Holdings companies, strategic partners, and ad partners; marketing has an unsubscribe path.
What rights do they take over what you type and what the AI makes?
Reviews and pictures can be used on the platform and for other commercial purposes everywhere, forever.
How long do they keep your data after you delete it, and can you delete it in the app?
Not stated in the documents.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They mention AI memories and personalization you can manage under Customization preferences in account settings.
Do they commit to basic security, and have they leaked data?
Not stated in the documents.
Is there a real age gate, and are teens protected?
You must be at least 18 to use the platform unless otherwise indicated; no age-assurance process is described.
Will they tell you when the rules change, and is the policy specific?
Terms are dated August 25, 2025. Privacy says they will try to warn people before significant changes, but the privacy notice itself has no date in the text.
Can they close your account without warning, and can you get your data out first?
They can cancel bookings and block the platform for reasons they consider good, and you may get no refund.
If something goes wrong, who pays?
Liability is generally capped at the booking cost with broad “as is” disclaimers, and you take full responsibility for legal claims about your reviews.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 7,799 words at a professional or legal expert level (Flesch reading ease 12.2); the terms are 15,880 words at a college level.
