Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
The Booking.com affiliate widget embeds search boxes and booking banners that set advertising and tracking cookies and share visitor data for affiliate attribution.
The Booking.com widget and affiliate tools let websites embed search boxes, deals banners and map widgets that link through to Booking.com. They are operated by Booking.com B.V., based in the Netherlands and part of the US group Booking Holdings, and are used by publishers and travel sites to earn affiliate commission.
When a Booking.com widget loads, it can set advertising and analytics cookies and read identifiers used for affiliate attribution and retargeting. It collects the visitor IP address, the pages and searches viewed and click data used to credit referrals. Much of this is marketing data that profiles the visitor.
Because the widget sets non essential cookies and shares personal data for advertising and attribution, it is squarely within the ePrivacy consent rule and the GDPR. You and Booking.com may be joint controllers for parts of the processing, so a clear allocation of responsibilities is needed.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Advertising and affiliate cookies require prior, opt in consent before the widget loads. A simple banner that blocks the widget until the visitor accepts marketing cookies is the standard approach. Consent must be as easy to refuse as to give.
Booking.com B.V. is in the EU, but as part of Booking Holdings and through its advertising partners, data may be transferred to the United States. Those transfers should rely on the EU US Data Privacy Framework or Standard Contractual Clauses, which you should confirm in the Booking.com data processing terms.
Load the widget only after marketing consent, categorise its cookies as advertising in your consent manager, and disclose Booking.com and the possible US transfer in your privacy and cookie policies. Review the affiliate terms to understand the controller relationship.
Websites using Booking.com must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended where the Booking.com widget is used for large scale advertising, retargeting or affiliate profiling. Assess the marketing cookies, the joint controller relationship and any United States transfer.
Sample consent text
We use the Booking.com widget for travel search and offers. It sets advertising cookies and shares data with Booking.com for affiliate tracking. It loads only if you accept marketing cookies.
Third-party domains contacted
booking.combstatic.comdistribution-xml.booking.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| bkng | Functional | 1 year | Stores preferences and the affiliate context for the Booking.com widget. |
| aid | Advertising | 1 year | Affiliate identifier used to attribute referrals and commissions to your site. |
| pcm_consent | Functional | 6 months | Records the visitor consent state for Booking.com personalisation and advertising. |
Booking.com uses cookies for user preferences — inform visitors with a consent banner.
Yes, it sets advertising and analytics cookies and reads identifiers used for affiliate attribution and retargeting. These are non essential marketing cookies that need consent.
Yes, because it places advertising cookies and shares personal data for marketing, you must obtain prior opt in consent before the widget loads.
Consent under Article 6(1)(a) of the GDPR is the appropriate basis, together with the ePrivacy consent rule for the advertising cookies. Legitimate interest is not suitable for marketing trackers.
Booking.com B.V. is in the Netherlands, but as part of Booking Holdings and through ad partners data can reach the United States, relying on the EU US Data Privacy Framework or Standard Contractual Clauses.
A DPIA is advisable when the widget supports large scale advertising, retargeting or profiling. Assess the marketing cookies, transfers and the joint controller relationship.
Block it until marketing consent is given, classify its cookies as advertising, disclose Booking.com and the US transfer, and review the affiliate and data processing terms.
You can link to Booking.com with a plain text or image link that sets no cookies until the user clicks through, or use a privacy friendly booking provider. Static links avoid pre consent tracking.
List the Booking.com advertising and analytics cookies, their purpose and duration, state that the widget loads only after marketing consent and disclose the possible US transfer.