Hotels.com

Is Hotels.com safe?

For booking a hotel, yes. Hotels.com is part of Expedia Group, we found no reported breach of its own systems in the last 10 years, and its privacy statement is readable and detailed. The cost is advertising: the app shares your email and what you search for with ad partners. Like every big booking site, it also has to deal with criminals who pose as hotels. We score Hotels.com 57/100, a little above Expedia (54), whose app tracks far more.

What the app shares with advertisers

Apple's label for Hotels.com is shorter than Expedia's. Only "other user content" is listed as used to track you across other companies' apps and websites. Your email address is linked to you and used for third-party advertising, and purchase history, name, search history, user ID and device ID are linked to you for Hotels.com's own marketing. Location, photos and support chats are listed as not linked to you.

Google Play says more about sharing. The Android app shares emails with other companies for advertising, device IDs for analytics, advertising and fraud checks, and in-app search history for advertising and personalisation. It also lists web browsing history collected for advertising and calendar events collected for app functions.

The privacy statement, last updated in December 2025, fills in the rest. Hotels.com may give personal data to "targeted advertising partners", which California law treats as sharing. It also passes data to social media platforms, search engines and other online platforms, which may match it against what they already hold to build audiences for Hotels.com's ads. Expedia Group companies use your account data jointly, so one login and profile now work across several brands.

Fake hotel messages

Booking platforms have become a target for a simple trick: a criminal takes over a hotel's account and messages guests through the official chat, saying a card check failed and the room will be cancelled unless the guest re-enters card details through a link. Booking.com has had the worst of it, but Expedia Group is not immune. In April 2024 Germany's hotel association reported such a message sent through Expedia's messaging service. Hotels.com moved onto the same technology platform as Expedia in 2023, so treat its booking chat with the same caution.

Hotels.com has a history here too. In June 2015 it told customers that someone posing as Hotels.com or their hotel, by email and text, had tricked some of them into giving up names, phone numbers, emails and bookings. Hotels.com responded by adding multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for its hotel partners. That was more than 10 years ago, so it does not lower the score, but the weak point then, as now, was the hotel side of the platform.

Hidden fees and the UK undertakings

Hotels.com's main brush with a regulator came in the UK. In 2019 the Competition and Markets Authority took enforcement action against six booking sites: Expedia, Booking.com, Agoda, Hotels.com, ebookers and trivago. All six formally committed to stop claims about how many others were looking at a room, to stop discounts measured against prices that barely applied, to say when commission affected the order of results, and to show the full price up front. They had made the changes by September 2019. There was no fine and no court finding, but undertakings are binding promises the CMA can enforce in court, which is why they weigh more than a signature on voluntary principles.

In the US the bigger change came from the Federal Trade Commission's rule on unfair or deceptive fees, in force since May 2025, which requires booking sites to show mandatory hotel fees in the displayed price. We found no state or federal action naming Hotels.com over fees. Texas's 2025 junk-fee settlement was with Booking Holdings, owner of Priceline, not Expedia Group.

Security

Expedia Group runs a public bug bounty on HackerOne, opened in November 2022, that lists *.hotels.com and the Hotels.com Android and iPhone apps in scope and pays up to $20,000 for a critical flaw. A separate disclosure programme for other reports pays nothing. Agoda and Booking.com also pay researchers through their own programmes. The privacy statement mentions PCI DSS certification, SSL encryption in transit, and one-time passcodes sent by email or text when a login needs extra checks.

How to book on Hotels.com more safely

1. Treat any message asking you to re-enter card details or pay through a link within hours as a scam, even inside the Hotels.com app.
2. Check whether a payment is really due by opening the trip in the app yourself.
3. Find the support number in the app, not through a search ad.
4. In the US, use the "opt out of sale or sharing" option in the privacy statement and refuse tracking when your iPhone asks.
5. Compare total prices with taxes and fees, and pay by credit card for chargeback protection.

How we scored it

Privacy (45) is the weakest factor, because the app shares your email and searches for advertising and the policy allows ad-audience matching with social media. Regulatory record (75) is the strongest: the 2019 UK undertakings carry no fine but are binding commitments. Security (63) reflects a clean record on Hotels.com's own systems and a paid bug bounty. Vrbo, another Expedia Group app, also scores 57.