Booking.com: Hotels & Travel
Utility location · declared: 15 data types collected, 13 shared Tracks you
Measured network activity crowdsourced
Observed in donated App Privacy Reports — measured on real iPhones by iOS itself, not declared by the developer. Every row below was reported by at least 3 separate accepted donations and published under a human verdict — rows marked inherited verdict arrived after a reviewer approved this app's evidence and inherited that decision. Contact counts and dates are aggregates across the donated reports.
| Contacted domain | Company | Classification | Donations | Contacts | Seen |
|---|---|---|---|---|---|
gtp-app-dot-b-ppc-app-prod-u2xv6z.ew.r.appspot.com |
— | unknown | 4 | 20 | 2026-07-28 → 2026-07-29 |
ssl.google-analytics.com |
Google LLC 1 |
analytics | 4 | 20 | 2026-07-28 → 2026-07-29 |
app-analytics-services.com |
— | unknown | 4 | 16 | 2026-07-28 → 2026-07-29 |
cf.bstatic.com |
— | cdn | 4 | 16 | 2026-07-28 → 2026-07-29 |
data.emb-api.com |
Embrace Mobile, Inc. 1 |
analytics | 4 | 16 | 2026-07-28 → 2026-07-29 |
googleads.g.doubleclick.net |
Google LLC 1 |
advertising | 4 | 16 | 2026-07-28 → 2026-07-29 |
mobile-apps.booking.com |
— | first-party | 4 | 16 | 2026-07-28 → 2026-07-29 |
q-xx.bstatic.com |
— | cdn | 4 | 16 | 2026-07-28 → 2026-07-29 |
r-xx.bstatic.com |
— | cdn | 4 | 16 | 2026-07-28 → 2026-07-29 |
a5lng2.cdn-settings.appsflyersdk.com |
— | analytics | 4 | 12 | 2026-07-28 → 2026-07-29 |
a5lng2.launches.appsflyersdk.com |
— | analytics | 4 | 12 | 2026-07-28 → 2026-07-29 |
account.booking.com |
— | first-party | 4 | 12 | 2026-07-28 → 2026-07-29 |
api.ipify.org |
— | unknown | 4 | 12 | 2026-07-28 → 2026-07-29 |
config.emb-api.com |
Embrace Mobile, Inc. 1 |
analytics | 4 | 12 | 2026-07-28 → 2026-07-29 |
d8c14d4960ca.edge.sdk.awswaf.com |
— | unknown | 4 | 12 | 2026-07-28 → 2026-07-29 |
mobile-data.onetrust.io |
— | unknown | 4 | 12 | 2026-07-28 → 2026-07-29 |
pubads.g.doubleclick.net |
Google LLC 1 |
advertising | 4 | 12 | 2026-07-28 → 2026-07-29 |
secure-mobile-apps.booking.com |
— | first-party | 4 | 12 | 2026-07-28 → 2026-07-29 |
firebase-settings.crashlytics.com |
Google LLC 1 |
analytics | 4 | 8 | 2026-07-28 → 2026-07-29 |
firebaselogging-pa.googleapis.com |
Google LLC 1 |
analytics | 4 | 8 | 2026-07-28 → 2026-07-29 |
g.doubleclick.net |
Google LLC 1 |
advertising | 4 | 8 | 2026-07-28 → 2026-07-29 |
gspe19-ssl.ls.apple.com |
— | first-party | 4 | 8 | 2026-07-28 → 2026-07-29 |
img.riskified.com |
— | tracker | 4 | 8 | 2026-07-28 → 2026-07-29 |
muf.app-ads-services.com |
— | unknown | 4 | 8 | 2026-07-28 → 2026-07-29 |
otel-gw.booking.com |
— | first-party | 4 | 8 | 2026-07-28 → 2026-07-29 |
pagead2.googlesyndication.com |
Google LLC 1 |
advertising | 4 | 8 | 2026-07-28 → 2026-07-29 |
t-cf.bstatic.com |
— | cdn | 4 | 8 | 2026-07-28 → 2026-07-29 |
tpc.googlesyndication.com |
— | advertising | 4 | 8 | 2026-07-28 → 2026-07-29 |
www.booking.com |
— | first-party | 4 | 8 | 2026-07-28 → 2026-07-29 |
c.riskified.com |
Riskified Ltd. 1 |
unknown | 4 | 4 | 2026-07-28 → 2026-07-29 |
cdn.cookielaw.org |
— | cdn | 4 | 4 | 2026-07-28 → 2026-07-29 |
firebaseinstallations.googleapis.com |
— | unknown | 4 | 4 | 2026-07-28 → 2026-07-29 |
graph.facebook.com |
Facebook, Inc. 1 |
first-party | 4 | 4 | 2026-07-28 → 2026-07-29 |
gspe19-2-ssl.ls.apple.com |
— | first-party | 4 | 4 | 2026-07-28 → 2026-07-29 |
lh3.googleusercontent.com |
— | cdn | 4 | 4 | 2026-07-28 → 2026-07-29 |
odf.app-ads-services.com |
— | unknown | 4 | 4 | 2026-07-28 → 2026-07-29 |
odm.app-ads-services.com |
— | advertising | 4 | 4 | 2026-07-28 → 2026-07-29 |
platform-lookaside.fbsbx.com |
— | cdn | 4 | 4 | 2026-07-28 → 2026-07-29 |
securepubads.g.doubleclick.net |
Google LLC 1 |
advertising | 4 | 4 | 2026-07-28 → 2026-07-29 |
www.app-ads-services.com |
— | unknown | 4 | 4 | 2026-07-28 → 2026-07-29 |
www.googletagmanager.com |
Google LLC 1 |
analytics | 4 | 4 | 2026-07-28 → 2026-07-29 |
xx.bstatic.com |
— | cdn | 4 | 4 | 2026-07-28 → 2026-07-29 |
How to read this
- A contact is a measurement, not an accusation. iOS records that the app (or code inside it, like an ad or analytics SDK) reached the domain. It does not show what data was sent.
- Counts reflect the donors' usage. A heavily-used app produces more contacts; compare domains within this app, not across apps.
- Separate donations, not proven separate people. Donations are anonymous by design, so we can count donations — we cannot prove three donations came from three donors. Human review weighs that before anything publishes.
- "Not in label" is the finding that matters. It means measured behavior with no matching disclosure in the app's own store privacy label — the declared-vs-observed gap this database exists to expose.
Domain owner/type attribution from Apple's App Privacy Report where the donor's export carried it; tracker classification via the AdGuard companiesdb (CC BY-SA 4.0). You can add to this evidence: donate your own App Privacy Report — parsed in your browser, shared only with your per-app consent, accepted anonymously (no account, no email, no IP address stored).
Think something here is wrong?
Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.