U.S. Customs and Border Protection (CBP) has unveiled a set of sweeping proposed changes to the Electronic System for Travel Authorization (ESTA) application process. If finalized, these updates will dramatically increase the amount and type of personal data required from travelers seeking entry under the Visa Waiver Program (VWP).

At Cohen, Tucker + Ades, P.C., we are closely monitoring these developments, which represent an unprecedented expansion of data collection for business visitors and tourists entering the United States. The implications for privacy, travel convenience, and compliance are significant.

The Proposed Changes: A New Era of Scrutiny

CBP published a notice in the Federal Register detailing a significant revision to the ESTA application. These changes are designed to align with a January 2025 Executive Order focused on strengthening the vetting and screening of foreign nationals to the “maximum degree possible.”

For citizens of the 42 Visa Waiver Program countries (including the U.K., Australia, Japan, and most of Europe), the ESTA application process is set to become considerably more intrusive.

Mandatory Data Fields: What Information Will Be Collected?

The most notable change is the proposed addition of several mandatory and “high-value” data fields, which will require travelers to disclose extensive historical and biographical information, along with their digital footprint.

1. Digital and Online History (The Biggest Shift)

• Mandatory Social Media Information: For the first time, ESTA applicants will be required to provide their social media information (usernames/identifiers) from the five years preceding their application. Failure to provide this information, unless the applicant genuinely has no social media presence, could result in application scrutiny or denial.

• Email Address History: Applicants must provide all email addresses used in the last ten years.

• Telephone Number History: Applicants must provide all telephone numbers used in the last five years.

• Business Contact Information: This includes business telephone numbers used in the past five years and business email addresses used in the past ten years.

2. Expanded Biographic and Familial Data

The proposal seeks to collect highly detailed information about the applicant’s immediate family, including:

• Names of immediate family members (parents, spouse, siblings, and children).

• Dates and places of birth for these family members.

• Residencies of these family members.

• Family member telephone numbers used in the last five years.

• Biometrics: The proposal also includes the potential collection of new biometrics, such as DNA, iris scans, and fingerprints, in addition to the mandatory facial photo (or “selfie”) upload.

3. Application Method Transition

CBP plans to eventually decommission the ESTA website for new applications, requiring travelers to apply solely through the ESTA Mobile Application. This move is cited by CBP as a measure to enhance security and efficiency, particularly through the use of higher-quality mobile camera images for the mandatory facial photo upload.

The Implications for Travelers and Privacy

The proposed expansion of data collection raises significant concerns that VWP travelers and businesses relying on short-term visits must consider:

• Increased Scrutiny and Delays: The sheer volume of new data subjects applicants to a much higher level of scrutiny, potentially leading to increased likelihood of being flagged for closer review and longer waits for ESTA approval.

• Privacy and Civil Liberties: Requiring five years of social media history and extensive familial data raises serious privacy and free expression concerns. Critics argue this may encourage self-censorship among travelers who fear their political or personal opinions could jeopardize their travel authorization.

• Time Commitment: CBP estimates the additional information will add approximately 22 minutes to the application process, a notable increase for what is designed to be a simple travel authorization.

What Happens Next?

The CBP’s notice is a proposal, opening a 60-day public comment period from its Federal Register publication date (December 10). During this time, the public, advocacy groups, and stakeholders are invited to submit comments on the proposed changes. CBP will then review the feedback before issuing a final rule.

Cohen, Tucker + Ades P.C. encourages all affected individuals and businesses to follow this process closely and consider submitting comments to the Federal Register. The firm remains committed to tracking these and other evolving U.S. immigration policies that impact the rights and privacy of those interacting with the U.S. immigration system.

Concerns about how the proposed rule change may impact you or your employees. Contact us for a consultation: (212) 840-0050 or info@cohentuckerlaw.com

Disclaimer: This blog post contains general information and is for informational purposes only. It is not legal advice and does not create an attorney-client relationship between you and Cohen, Tucker + Ades P.C. Immigration laws and fee schedules are subject to frequent change. The information provided herein may not reflect the most current legal developments. You should not act or refrain from acting based on information contained in this post without seeking professional counsel from an attorney licensed in your jurisdiction. Cohen, Tucker + Ades P.C. expressly disclaims all liability in respect to actions taken or not taken based on any or all of the contents of this post.

Sources: 

Federal Register 90 FR 57208 | Agency Information Collection Activities; Revision; Arrival and Departure Record (Form I-94) and Electronic System for Travel Authorization (ESTA)