Digital Audit: Booking.com

Enterprise Technology Stack & Vendor Relationships

No public evidence identified of a licensing, subscription, or integration relationship between Booking.com and major Israeli-founded cybersecurity or enterprise-software vendors such as Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks. Booking.com’s primary disclosed cloud and infrastructure vendor relationship is with Amazon Web Services (AWS): the company’s CTO presented at AWS re:Invent 2023 on scaling generative-AI workloads across more than 150 petabytes of data, and AWS has published a series of case studies (2019–2024) covering Booking.com’s serverless advertising tooling and content-delivery-network migration ¹²³⁴⁵. Booking Holdings’ Form 10-K cybersecurity risk-factor disclosures describe general information-security governance practices but do not name specific technology vendors ⁶. An external security-posture assessment of Booking Holdings similarly does not disclose a vendor list ⁷. No public evidence identified of Booking.com being required, mandated, or recommended by systems integrators to adopt Israeli-origin technology as part of any major IT transformation programme.

Surveillance, Biometrics & Retail Technology

No public evidence identified of Booking.com using facial recognition, biometric identification, gait analysis, or behavioural-analytics products from Israeli vendors such as Trigo, BriefCam, AnyVision/Oosto, or Trax. No public evidence identified of Booking.com using Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools. No public evidence identified of such technologies being delivered to Booking.com indirectly through bundled third-party platforms or partners.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Booking.com maintains an Israeli research-and-development presence in Tel Aviv, but No public evidence identified indicates the company operates, leases, or co-locates data-hosting infrastructure inside Israel; the Tel Aviv operation is documented as an engineering/innovation office rather than a data centre ⁸⁹. Project Nimbus is a separately documented $1.2 billion Google Cloud/AWS contract to provide localized, in-country cloud infrastructure to the Israeli government, and reporting since October 2023 has described increased Israeli military cloud purchases from Google, AWS, and Microsoft ¹⁰¹¹. No public evidence identified of Booking.com’s own participation in Project Nimbus or any comparable Israeli sovereign-cloud programme; the only identified connection is at the vendor level - AWS, Booking.com’s disclosed cloud provider, is separately a Nimbus contractor to the Israeli government, but no source indicates that Booking.com’s own AWS workloads touch Nimbus-designated infrastructure ¹¹⁰. No public evidence identified of Booking.com providing data-sovereignty, data-residency, or infrastructure-resilience services to Israeli state institutions or military bodies.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any contract, partnership, or service agreement between Booking.com and the Israeli Ministry of Defence, the IDF, or Israeli intelligence agencies. No public evidence identified of Booking.com’s commercial technology being repurposed for Israeli military, intelligence, or law-enforcement surveillance. No public evidence identified of Booking.com developing, selling, licensing, or maintaining offensive cyber tools, zero-day exploits, or digital-weapons systems.

AI, Algorithmic & Autonomous Systems

No public evidence identified of Booking.com providing AI/ML, computer-vision, or decision-support systems to Israeli state, military, or security bodies. The company’s Tel Aviv AI centre, established following its 2017 acquisition of Israeli NLP/chatbot startup Evature, works on recommendation systems, computer vision, natural-language understanding, and reinforcement learning applied to Booking.com’s own consumer travel platform ^1213141516. No public evidence identified that Booking.com’s AI models were trained on, or given access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel/the Occupied Palestinian Territory. No public evidence identified of Booking.com providing autonomous targeting, threat-detection, or tracking systems to Israeli military or security forces; per the domain-boundary convention, any such finding would in any case fall under the separate Military military-sector audit rather than Digital.

Technology Ecosystem & R&D Footprint

Booking.com acquired Tel Aviv-based Evature, an NLP/chatbot travel-search startup, in September 2017 for an undisclosed sum; trade press characterized the deal, in which Evature had previously raised roughly $5 million, as an “acqui-hire” ¹²¹³¹⁴. In October 2017 Booking.com announced an AI-focused R&D and innovation centre in Tel Aviv, initially housed in Mindspace coworking space with roughly 40 employees planned and reporting directly to Amsterdam headquarters ¹⁵¹⁷¹⁸. The centre subsequently expanded and relocated to approximately 500 square metres spanning half of the 57th floor of the Azrieli Sarona tower ¹⁹²⁰, and Booking.com continues to list Tel Aviv as an active office location on its careers site ²¹. Publicly stated focus areas include recommendation systems, computer vision, natural-language understanding, reinforcement learning, marketplace algorithms, and voice interaction ¹⁵¹⁶²². No public evidence identified of other Israeli-origin technology-company acquisitions by Booking Holdings beyond Evature; a 2021 Form 8-K describing a transaction titled “Unicorn” was identified but its content, as surfaced in this review, could not be confirmed to involve an Israeli company and is flagged rather than substantiated as Israel-related ²³. No public evidence identified of patent portfolios, licensing agreements, or co-development arrangements between Booking.com/Booking Holdings and Technion, Hebrew University, the Weizmann Institute, or other Israeli research institutions.

Civil Society Scrutiny & Regulatory History

Booking.com has been listed in the UN Office of the High Commissioner for Human Rights’ database of business enterprises operating in connection with Israeli settlements since 2020 ²⁴²⁵; the database’s most recent update (26 September 2025) retained Booking.com among 158 total listed firms, following the addition of 68 new companies since the prior 2023 iteration ²⁶²⁷. The UN Special Rapporteur on the Occupied Palestinian Territory, Francesca Albanese, named Booking Holdings Inc. and Airbnb Inc. in her July 2025 report “From economy of occupation to economy of genocide” (A/HRC/59/23), stating that Booking.com labels some settlement properties “Palestinian territory, Israeli settlement” but continues to profit from them, and noting the company faces criminal complaints in the Netherlands for alleged laundering of proceeds ²⁴²⁸²⁹. Who Profits (data current to November 2024) classifies Booking.com under “Settlement Enterprise”/“Services to the Settlements” in the tourism sector, documenting 24 listings across 12 West Bank settlements, 7 East Jerusalem listings, and 152 listings across 28 settlements in the occupied Syrian Golan ⁹. AFSC Investigate documents that Booking.com operates an Israeli subsidiary, Israel Online Hotel Reservations Ltd., whose staff communicate directly with settlement accommodation providers, and records 2022 data of 19 West Bank/East Jerusalem listings and 25 Golan listings, at least 15 of which sit on Israeli-designated “state land” or privately owned Palestinian land ³⁰. Human Rights Watch’s November 2018 report “Bed and Breakfast on Stolen Land,” produced with Kerem Navot, identified 26 Booking.com properties in West Bank settlements as of July 2018 and determined land status for 25 of the 26; Booking.com’s written response to HRW stated it “does not buy or sell rooms” and functions only as a booking platform ³¹. West Bank listings reportedly grew from 26 in 2018 to 70 by May 2023, and East Jerusalem listings tripled to 39 in the year following October 2023 ²⁴. SOMO, ELSC, the Rights Forum, and Al-Haq investigations (2022–2023) identified 70 Booking.com listings (13 in East Jerusalem, 57 elsewhere in the West Bank) as the evidentiary basis for a Dutch criminal complaint ³². An Ekō report traced one Neve Daniel listing to land registered to the Al-Sbeih family of al-Khader near Bethlehem, seized in 1982 citing “national security,” with the family reportedly unable to access the land since ³³³⁴. In November 2023, SOMO, ELSC, the Rights Forum, and Al-Haq filed a criminal complaint against Booking.com in the Netherlands under Dutch anti-money-laundering law and the Dutch International Crimes Act’s prohibition on profiting from war crimes ³⁵³⁶; the Dutch Public Prosecutor announced in May 2024 that it would investigate ³², and the coalition subsequently filed an Article 12 procedure at The Hague Court of Appeal to compel prosecution after prolonged inaction, reported as ongoing ³⁷³⁸²⁵. In October 2025, a French rights group filed a complaint against Airbnb and Booking.com over Israeli settlement listings ³⁹⁴⁰. Internally, a petition signed by more than 220 employees in September 2025 called on Booking.com to cease settlement listings, and separate reporting described “hundreds of employees” organizing on the issue as early as 2023; CEO Glenn Fogel told employees in a September 2024 Q&A that “we have never said we won’t do business somewhere because we disagree with something,” and management reportedly asked staff to limit non-work-related discussion on the internal forum after October 2023 ⁴¹⁴². Earlier coverage examined Booking.com’s 2018 relabeling of settlement listings as a “reversal” scrutinized for potential corporate hypocrisy ⁴³, and other reporting has similarly characterized Booking.com and Airbnb as enabling settlers to profit from Palestinian land ⁴⁴. A November 2024 “Don’t Buy Into Occupation” report lists Booking Holdings among companies with financial relationships tied to Israeli settlement activity, alongside Airbnb and Expedia Group ⁴⁵. Separately, on competition and consumer-protection matters unrelated to the Israel nexus, Spain’s CNMC fined Booking.com €413.24 million in February 2024 for abuse of dominant market position ⁴⁶⁴⁷, and Booking Holdings’ most recent Form 10-Q discloses ongoing or recent competition-authority actions in Poland, France, Greece, and Hungary ⁴⁸. A 2026 report also describes a Booking.com-related data breach exposing information usable by scammers to target guests, with no Israel-jurisdiction nexus identified ⁴⁹. No public evidence identified of any export-control, sanctions, or technology-transfer regulatory action specifically involving Booking.com’s dealings with Israeli state entities. The OHCHR’s June 2023 database update document itself lists Booking.com among settlement-linked enterprises, though its row-level category text could not be independently extracted from the source PDF in this review and reliance is placed on secondary reporting of its contents ⁵⁰.

End Notes