Contact and booking form on your hotel website: privacy, spam and bots (2026)

Updated: 10 November 2026

For a small hotel, the contact form is often the first direct booking. It is also where spam gets in and where the website asks for the most personal data. This guide sums up what we could check on 10 November 2026 in the GDPR text, the Spanish data protection authority (AEPD), the Court of Justice of the EU (case C-673/17), the French CNIL and the PCI Security Standards Council, and flags what we could not confirm. It is general information, not legal advice.

The short answer

The essentials:

Next to the send button, show a short first layer of privacy information (who you are, why you use the data, the guest's rights) with a link to the full policy: the layered approach the AEPD recommends.
You do not need an "I accept the privacy policy" box: the AEPD answers that users do not have to consent to the privacy notice.
If you want to send promotions, use a separate, unticked box: the CJEU (C-673/17, Planet49, 1 October 2019) held that a pre-ticked box is not valid consent.
Ask only for what you need (GDPR Art. 5(1)(c)) and never for a card number in a form or by email.
To stop bots, the CNIL (29 April 2026) recommends alternatives to CAPTCHAs that reuse data, citing Google reCAPTCHA as an example.

What to show next to the form: layered information

GDPR Art. 13 and the AEPD:

GDPR Art. 13 requires you, when you collect data from the guest, to give: your identity and contact details, your data protection officer if you have one, purposes and legal basis, recipients, transfers outside the European Economic Area, storage period, rights, the right to complain to an authority, and whether the data is mandatory.
The AEPD recommends layered information: a first layer next to the form, "structured and very concentrated", and a second layer with the detail (your privacy policy), linked from the first.
Example first layer (our suggestion, check it with your adviser): "Controller: [company name]. Purpose: to answer your enquiry or booking request. Rights: access, rectification, erasure and others, as explained in the privacy policy [link]".
If you use a third-party booking engine, CRM or form service, list it in the second layer as a recipient and say whether data leaves the EEA.
The exact headings the AEPD wants in the first layer: not confirmed in what we read.

The consent box: for marketing only

What the Court of Justice of the EU said:

In case C-673/17 (Planet49), on 1 October 2019 the CJEU held that consent is not valid if collected with a pre-ticked box that users must untick to refuse.
It also held that clicking the button to take part (there, in a lottery) is not consent for something else: consent must be specific.
Applied to your website (our suggestion): answering an enquiry needs no box; sending newsletters or offers does. Make that box separate, unticked and clearly worded: "I'd like to receive offers from the hotel".
If the guest consents, Art. 13 requires telling them they can withdraw consent at any time.

Which data to ask for: minimisation

GDPR Art. 5(1)(c):

The GDPR requires data to be "adequate, relevant and limited to what is necessary" for the purpose (data minimisation).
For an enquiry or booking request, name, one contact method (phone or email), dates, number of guests and a message are usually enough. Our suggestion.
Do not ask for date of birth, ID document, postal address or health data in the form: if you need them later (for example, for guest registration), ask at that point through the proper channel.
Make only essential fields mandatory: Art. 13 asks you to say whether data is mandatory and what happens if it is not given.

Never ask for card details in a form

PCI Security Standards Council (10 October 2016):

The PCI SSC says: "The best way to protect against data breaches is not store card data at all."
It advises against accepting card details by email and suggests outsourcing card processing to a PCI DSS compliant provider.
A contact form usually ends up in a mailbox or a website database, so it should have no card fields. This last point is our advice; the PCI SSC post does not mention forms.
If you need a guarantee, use the payment gateway of your booking engine or bank, or take payment at the property.

Spam and bots: reCAPTCHA and cookie-free alternatives

What we could check:

The CNIL (Q&A of 29 April 2026) says a CAPTCHA used only for site security needs no consent, but does if it also serves other purposes that are not strictly necessary.
The CNIL cites Google reCAPTCHA as an example of a provider that reuses data for its own purposes, asks sites to check its terms and recommends alternative solutions.
What the AEPD, the Italian Garante or the Portuguese CNPD say about reCAPTCHA, and whether it involves international transfers: not confirmed.
Cookie-free alternatives (our practical advice, not any authority's view): a hidden honeypot field that humans leave empty, a simple question ("How many nights?"), a limit on submissions per minute, and rejecting messages sent within a few seconds.
Whatever you choose, mention it in your privacy or cookie policy.

Deadlines: replying and keeping data

GDPR Arts. 12(3) and 5(1)(e):

If someone asks for access, erasure or another right, Art. 12(3) requires a reply without undue delay and within one month at most; this can be extended by two further months where necessary, telling the person within the first month.
We found no legal deadline for answering an enquiry or booking request: not confirmed. Replying the same day is good business practice.
Form messages must be kept "for no longer than is necessary" (Art. 5(1)(e)). Set a period, state it in your privacy policy and delete messages that did not lead to a booking.
A specific number of days or months for keeping these messages: not confirmed.

If you run a property: what travellers ask AI

Questions your website should answer clearly:

"Can I book directly with the hotel without giving my card?"
"How do I contact the hotel to ask for an extra bed or a late arrival?"
"Does the hotel reply quickly to enquiries?"
Publish your phone number, payment method and cancellation terms as text on your website, not only inside the form. We cannot guarantee that an AI assistant will use that information.

How iQuota helps

iQuota makes independent properties available to AI assistants with direct booking, payment at the property and 0% commission, at the price and terms each property sets. We cannot guarantee that an AI assistant will recommend you.

Want AI to give your real details, with direct booking and no commission? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Do I need an "I accept the privacy policy" box?

Not to answer an enquiry: the AEPD answers that users do not have to consent to the privacy notice. You must inform them (GDPR Art. 13), for example with a first layer next to the form.

Can the offers box be pre-ticked?

No. The CJEU (C-673/17, Planet49, 2019) held that a pre-ticked box is not valid consent.

Can I ask for a card in the form to guarantee the booking?

It is not a good idea. The PCI SSC says the best approach is not to store card data and to outsource processing to a PCI DSS compliant provider.

Is using reCAPTCHA illegal?

We cannot say so. The CNIL (2026) says it needs consent if it serves purposes that are not strictly necessary and recommends alternatives; the AEPD's view is not confirmed.

How fast must I answer an erasure request?

Without undue delay and within one month at most, extendable by two further months (GDPR Art. 12(3)).

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά