On December 9, 2025, U.S. Customs and Border Protection (CBP), part of the Department of Homeland Security (DHS), proposed significant changes to the Electronic System for Travel Authorization (ESTA) application process currently used by Visa Waiver Program (VWP) travelers from 42 countries. CBP’s proposal, published as an "information collection request" under the Paperwork Reduction Act, rather than a formal notice of proposed rulemaking, would require ESTA applicants to provide their social media history for the past five years, as well as expanded personal, family, and biometric data. If adopted, these measures could adversely impact U.S. tourism and prompt other countries to impose similar requirements on U.S. citizens. Air carriers, cruise lines, tour operators, and other stakeholders should consider submitting comments to CBP by the February 9, 2026, deadline.

BACKGROUND

Since 1986, the VWP has allowed citizens of designated countries to visit the United States for business or tourism stays of up to 90 days without obtaining a B-1 or B-2 visa. A given country’s eligibility for designation under the program is assessed by DHS in consultation with the Department of State.¹ Participation in the VWP requires each participating country to grant U.S. citizens similar visa-free access and to adopt enhanced cooperation on counterterrorism, law enforcement, and immigration enforcement. In addition to facilitating reciprocal security enhancements, DHS asserts that the program has delivered significant economic benefits to the United States.²

Since 2009, DHS has also conducted individual traveler vetting by requiring each VWP applicant to obtain pre-travel authorization from CBP through an online ESTA portal before boarding a U.S.-bound flight or vessel, or seeking entry at a border crossing. DHS screens ESTA data against multiple law enforcement and counterterrorism databases before authorizing an eligible VWP applicant to travel under the program. Travel authorizations processed through ESTA are valid for two years, or until the applicant’s passport expires, whichever comes first, unless sooner revoked by DHS based on reassessed security risks or travel history changes.

CURRENT ESTA REQUIREMENTS

ESTA applicants must currently provide:

• Passport from a VWP country
• Email address
• Home address and phone number
• Emergency contact phone and email

CBP may also require additional information from the applicant, such as:

• Selfie photo
• Aliases or other names
• National ID or Personal ID number
• Global Entry/NEXUS/SENTRI ID number
• Employer address and phone number
• U.S. point of contact name, address, and phone number

PROPOSED CHANGES TO ESTA

CBP’s proposal would significantly expand the information required from ESTA applicants.

Social Media

CBP proposes to require ESTA applicants to provide their social media history from the past five years, but offers no further details on what this requirement entails. Commenters may wish to seek clarification on several key considerations, including:

• What qualifies as “social media” for purposes of this requirement?
• Whether applicants must provide only usernames or a full record of posts.
• Whether CBP intends to access private messages or only public content.
• How an applicant’s social media history will factor into admissibility decisions.
• The extent to which this requirement would discourage U.S. travel.

High-Value Data Elements

CBP also proposes to add several “high-value data elements” to the ESTA application. These new data fields would include:

• Telephone numbers used in the past five years.
• Email addresses used in the past ten years.
• IP addresses and metadata from electronically submitted photos.
• Names, dates of birth, places of birth, and residences of family members (parents, spouse, siblings, children).
• Family member telephone numbers used in the last five years.
• Biometrics—face, fingerprint, DNA, and iris data.
• Business phone numbers used in the last five years, and business email addresses used in the past ten years.

Commenters may wish to raise issues with these proposals, including:

• The burden of maintaining and providing this level of historical data.
• Whether all elements are necessary at the initial application stage or should be reserved for targeted secondary screening.
• Privacy and security implications of storing highly sensitive identifiers such as biometrics
• Potential burdens on U.S. citizens if other countries adopt reciprocal requirements on U.S. travelers.

ESTA Website Decommission

In addition to the proposed information collection expansions, CBP, citing security and efficiency benefits, proposes to retire web-based ESTA applications and make the ESTA mobile app the sole submission platform.

Commenters may wish to address:

• Accessibility challenges for travelers without smartphones.
• Whether a dual-platform option should remain as a backup.

NEXT STEPS

Air carriers, cruise lines, tour operators and travel agencies, and other stakeholders should review key aspects of CBP’s proposal and commit sufficient time and resources to prepare comments. In our experience, well-crafted, artful submissions supported by documented evidence will be the most impactful. As noted above, public comments are due by February 9, 2026.