Expedia

Is Expedia safe to use?

For booking, yes: Expedia is a large, established agent, and we found no reported breach of its own systems in the last 10 years. What should make you cautious is not the booking itself but what happens around it. The app's privacy label is one of the most extensive we have seen in travel, and criminals have started using Expedia's own messaging service to ask guests for card details. We score Expedia 54/100.

What the app tracks

Apple asks developers to list the data that may be used to track you across other companies' apps and websites. For most travel apps that list is short: device identifiers, sometimes usage data. Expedia's is long. It names purchase history, payment info, precise and coarse location, physical address, email address, name, phone number, search history, user and device IDs, product interaction and diagnostics.

Linked to your identity and used for third-party advertising are purchase history, coarse location, email, search history and identifiers. Google Play tells a similar story: search history and emails are shared with other companies for advertising and personalisation, and device IDs for analytics, advertising and fraud checks. Both stores say data travels encrypted and that you can ask for deletion.

Expedia.com returned a bot check to every automated request, so we read the Expedia Group privacy statement through an archived copy on its sister site Hotels.com, last updated in December 2025. It says the group's companies use your data jointly and that Expedia, Inc. is responsible for it. It also confirms the advertising use: data shared for targeted ads may count as "sharing" under California law, and some US residents can opt out. You can access, correct or ask to delete your data through your account or customer service, and, depending on where you live, get a copy, port it or object to its use. The privacy score still rests mainly on what Expedia told Apple and Google. That is already enough to put its privacy score (38) below that of Booking.com (50), whose label lists only identifiers for tracking.

The hotel-message scam

The phishing wave that has hit Booking.com for years is not unique to it. In April 2024 Hotelverband Deutschland, the German hotel association, reported a message sent through Expedia's messaging service in the name of a booked hotel. It said verification of the guest's payment card had failed and that the room would be cancelled unless the card details were entered again through a personal link within 24 hours. The association said such attempts had until then been seen almost only on Booking.com.

Expedia has been here before. In June 2015 it warned customers that a criminal had obtained names, phone numbers, emails and booking details. The company said the data came not from its own systems but from a partner hotel whose login had been phished, and that it had added multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for hotel partners. That case is more than 10 years old, so it does not lower today's score, but it shows that the weak point is the hotel side of the platform.

Because these messages can quote your real hotel and dates, the only reliable check is to open the booking in the app yourself and see whether a payment is really due.

Security and sister brands

Expedia Group runs two programmes on HackerOne. A public bug bounty, opened in November 2022, covers Expedia, Hotels.com, Vrbo, Orbitz, Travelocity, Hotwire, Wotif and their Android and iPhone apps, and pays up to $20,000 for a critical flaw. A separate disclosure programme takes other reports and pays nothing. That puts Expedia level with Agoda and Booking.com, whose programmes also pay researchers.

The group's history matters as context. Trivago, an Expedia Group company, was ordered by Australia's Federal Court in April 2022 to pay A$44.7 million after the ACCC showed that its "best price" claims favoured hotels that paid it the most per click. Trivago is a separate company and app, so the penalty does not count against Expedia, but it is a reminder that ranking claims deserve scepticism.

What regulators have done

The main action against Expedia itself came from the UK. The Competition and Markets Authority opened an investigation into hotel booking sites in October 2017. In February 2019 six sites, including Expedia, Hotels.com and ebookers, gave formal undertakings to change practices the CMA thought might mislead people: claims about how many others were looking at a room, discounts measured against prices that barely applied, rankings shaped by commission, and charges added late in the booking. All six had made the changes by September 2019. There was no fine and no finding that the law was broken, but undertakings are binding commitments the CMA can enforce through the courts.

We found no fine on Expedia by a privacy or consumer regulator in the last 10 years.

How to book on Expedia more safely

1. Treat any message asking you to re-enter card details, pay by transfer or click a link within hours as a scam, even inside the Expedia app.
2. Check payment status yourself in the trip page, not from a message.
3. Get Expedia's support number from the app, not from a search ad.
4. Refuse tracking when the app asks, or turn off "Allow Apps to Request to Track" in iPhone settings.
5. Pay by credit card, which gives you a chargeback route if a booking goes wrong.

How we scored it

Privacy (38) is the weakest factor, because Expedia lists contact, payment, location and search data as usable for tracking. Regulatory record (75) is the strongest: there is no fine, but formal UK undertakings over misleading sales tactics are binding commitments, so they weigh more than a warning, though less than an order after a finding. Security (63) reflects a clean record on its own systems and a paid bug bounty, held back by hotel-side phishing. Trip.com scores 52, and Booking.com 47.