The law made Booking give you data. It did not make Booking give you guests.

Picture this: January, a five-star hotel in Marbella. The sales team downloads the year’s reservations from the extranet to write to the Easter guests and invite them back. They have names, dates, room types and amounts. In the email column, alias addresses. And the window for writing to the people who left in April closed a week after they checked out.

Since Booking became a “gatekeeper” under the EU Digital Markets Act, it is easy to read that hotels will finally get their guests’ data. That is half true, and the missing half is the one that matters.

What the law says.

The European Commission designated Booking Holdings as a gatekeeper on 13 May 2024, and since 14 November 2024 Booking.com has had to comply with the regulation’s obligations. For hotels, the first visible effect was the end of price parity clauses. But two articles deal with something discussed far less: the relationship with the customer.

Article 5(4) requires Booking to allow hotels, free of charge, to communicate and promote offers, including under different conditions, to customers acquired via the platform or through other channels, and to conclude contracts with them. Article 6(10) requires it to give the hotel, and third parties the hotel authorises, on request and free of charge, effective, high-quality, continuous and real-time access to the data generated by its business on the platform, aggregated and non-aggregated. That includes personal data, on two conditions: the data must be directly connected with what the customer did with that hotel, and the customer must opt in by giving consent. Article 13(5) adds that, where consent is required, Booking must take the necessary steps to let the hotel obtain it directly, and must not make that more burdensome than for its own services.

What Booking explains.

In its public compliance report of November 2025, Booking says that for accommodation the main data access tool is the extranet, which already offered data and analytics before the regulation, and that it now allows more data to be downloaded from it. It adds that hotels can create sub-accounts for third parties, and that it has improved its messaging, with AI-assisted replies and a messaging API. In the section on Article 6(10), I find no new mechanism through which a hotel receives its guests’ real email addresses, nor one through which guests can consent to sharing them.

Booking’s technical documentation confirms this from another angle. Among the reservation details a connected system must show the hotel is the booker’s “alias email address”. And its messaging lets the property write from the time of booking until seven days after checkout or cancellation; if the guest writes, the hotel can reply for fourteen days. Conversation history is kept for one year.

In November 2024, a manager at Triptease, a company that sells direct-booking technology to hotels and therefore has a stake in the matter, wrote that under Booking’s approach hotels would still lack access to phone numbers and email addresses, and that this was arguably at odds with Article 6(10). According to the same piece, Booking argued that it complies with Article 5(4) because it does not prevent direct communication outside the platform once the guest’s first stay has started.

The door almost nobody looks at.

Article 6(9) also requires Booking to let travellers take their own data with them. According to its report, a traveller signed in from the European Economic Area can generate a link and share with a registered third party their reservations, contact details, reviews and search history, once or continuously for 180 days. The third party must first go through registration with identity, privacy and security checks. I know of no hotel that uses it, and I do not know whether it would pay off for an independent hotel. But it shows the logic of the regulation: personal data moves when the guest decides to move it.

What I do not know.

I do not know whether the European Commission considers Booking’s approach to Article 6(10) sufficient: in September 2026 it published Booking’s changes on pricing, not on data. I do not know how all this applies to a Swiss hotel, because the regulation covers services provided to businesses established in the Union or to users located there, and Switzerland is not a member. And I have not read your contract with Booking. I am not a lawyer: what your hotel may do with each piece of data, and through which channel, is a question for your legal counsel.

The blind spot: the stay is the window.

If the law does not bring you the email address, the opportunity lies elsewhere: in the days the guest spends at your hotel. That is when they can give you their real address, for something specific they want, in their language and with their consent. The restaurant’s menu for next season, the date the terrace reopens, the suite they asked about that was taken. No regulation does that work for you. Reception does it, the room does it, and so does what your website shows when the guest looks up your hotel afterwards.

An alias is good for announcing an arrival. It is no good for inviting someone back.

Where I stand.

I do not think a luxury hotel should wait for Booking to hand over email addresses, or treat the guest relationship as a fight with the platform. I would use everything the extranet already offers, because it is free and describes your own clientele, and I would design with care the moment when the guest decides to give you their contact details: a clear, optional proposal, in their language, with a purpose they understand and a record of their consent. After that, every message has to be worth opening. Booking introduces the guest. Whether they come back through you depends on what happens while they are under your roof.

What I would check.

• What you already download. Which data you take from the extranet today, who uses it and for which decision.
• The sub-accounts. Which third parties have access to your extranet and whether any of them should lose it.
• The messaging window. What you send before arrival and in the seven days after departure, and in which language.
• The consent moment. Whether there is a clear, optional way, at reception or during the stay, for the guest to give you a real email address, with its purpose.
• Your website after the stay. What the guest finds when searching for your hotel by name, and whether it gives them a reason to book direct.

Where to start.

1. This week

   Export and look

   Your Booking reservations for the last twelve months: which data you have, which you do not and who sees it.

2. This month

   Write the proposal

   What you will offer the guest in return for their email address, in each language, reviewed by your legal counsel.

3. This quarter

   Automate the window

   Messages before arrival and after departure, within Booking’s time limits and in each guest’s language.

4. Every season

   Count

   How many Booking guests gave you their contact details, and how many came back by booking direct.

Think of the last guest who came back to your hotel. Did they return for you or for the platform? If you cannot say, perhaps the important question is not which data Booking gives you.

A simple test: take ten stays from last month booked through a platform and count how many of those guests received something from your hotel that could only have come from your hotel, a name remembered, a recommendation, a reason to write to you directly next time. The law opened a door to the data. What happens during the stay is still up to you.

If you would like me to review what your hotel does with Booking’s data today and how it turns a stay into a direct relationship, start with the Strategic Diagnostic. What your contract with each platform allows is for your legal advisers to decide, not a designer.