A U.S. plan to collect five years of social media information from travelers using the Visa Waiver Program is considerably broader than a social-media screening requirement alone. U.S. Customs and Border Protection proposed making social media a mandatory data element for Electronic System for Travel Authorization, or ESTA, applications, while also seeking additional information ranging from previous telephone numbers and email addresses to family details and, where feasible, expanded biometric data.
The proposal affects travelers eligible for the Visa Waiver Program, which allows citizens or nationals of participating countries to travel to the United States for tourism or business for stays of up to 90 days without obtaining a conventional visitor visa. As of September 2026, CBP’s official ESTA system lists 41 participating countries, including the United Kingdom, France, Germany, Japan, South Korea, Australia, Israel, Singapore and Qatar.
The distinction between a proposal, an approved information collection and an already operational requirement is important. CBP published the expanded collection in December 2025 through the Paperwork Reduction Act process and invited public comments, rather than announcing a conventional immigration rule that instantly changed the requirements for every traveler. Anyone preparing an ESTA application should therefore rely on CBP’s current application requirements rather than assuming every data field described in the 2025 notice is necessarily being requested in exactly the form originally proposed.
CBP Proposed Five Years of Social Media Information
The most widely reported part of the December 2025 notice concerned social media. CBP said it intended to make social media a mandatory element of an ESTA application and require applicants to provide information covering their social media presence during the previous five years. The agency linked the change to President Donald Trump’s January 2025 Executive Order 14161, which directed federal agencies to strengthen screening and vetting of foreign nationals seeking admission to the United States.
The proposal represents an expansion of a screening practice that predates Trump’s second administration. Social media identifiers have appeared in U.S. immigration and travel vetting for years, and the federal government has previously considered making such information mandatory in ESTA. In a previous review completed in 2023, the Office of Management and Budget approved an ESTA information collection only after CBP removed social media identifiers as a required field and kept them optional.
That history matters because it shows that proposals to expand traveler data collection can change during administrative review. It also demonstrates that the current debate is not simply about whether the government can look at publicly available online activity; it concerns whether millions of travelers should be required to disclose identifying information about their online presence as a condition of applying for visa-free travel authorization.
The Proposal Extends Far Beyond Social Media
Social media attracted the headlines, but CBP’s proposed data expansion was much wider. The agency listed telephone numbers used during the previous five years and email addresses used during the previous 10 years among the additional information it wanted to collect. It also identified IP addresses and metadata associated with electronically submitted photographs, as well as business telephone numbers and business email addresses covering similar periods.
Family information formed another substantial part of the proposal. CBP listed names of parents, spouses, siblings and children, along with family members’ telephone numbers, dates and places of birth, residences and other identifying information. Collecting these data points would give the ESTA screening process a significantly larger set of relationships and historical identifiers through which applicants could potentially be checked against government databases.
The notice additionally listed face, fingerprint, DNA and iris information under a category of potential biometric data. That wording requires careful interpretation: the Federal Register notice said CBP would add several “high value data fields” when feasible, so it should not be read as evidence that every ESTA applicant is currently required to submit DNA or iris scans. The more accurate conclusion is that CBP proposed an architecture capable of collecting substantially more biometric and biographical information than the traditional ESTA application.
ESTA Could Also Become a Mobile-Only Application
Another significant proposal received less attention than the social-media requirement. CBP said it wanted to decommission the ESTA website as a platform for submitting new applications and make the ESTA Mobile application the sole application channel. The website would remain available for information and checking application status, but travelers would no longer submit new ESTA applications through it under the proposed model.
CBP argued that mobile applications offer stronger identity-verification capabilities. The ESTA Mobile process can read the electronic chip in compatible passports through Near Field Communication, retrieve biographical information and the passport portrait, capture a live selfie and compare that image with the passport photo. CBP said those capabilities make it more difficult to use fraudulent travel documents or manipulate uploaded photographs.
The agency cited thousands of problematic image submissions as evidence for the change, including more than 2,400 poor-quality passport biographical-page uploads and more than 8,000 invalid passport photographs that produced negative or failed comparison screenings. CBP also said its investigators had found hundreds of fraudulent ESTA authorizations associated with facilitators using false passport information, giving the agency a security rationale for pushing applicants toward stronger mobile identity verification.
Why the Government Says It Wants More Traveler Data
CBP tied the social-media expansion to Executive Order 14161, issued by President Trump on January 20, 2025. The order directed federal agencies to use available resources to strengthen screening of people seeking admission to the United States and to identify information needed to determine whether applicants pose national-security or public-safety risks.
From the government’s perspective, collecting more historical identifiers can make it easier to connect an applicant with records that might otherwise be missed. Someone may change a telephone number, abandon an email address or use different usernames across multiple online platforms, while family and business information can provide additional points for identity verification and security screening.
The challenge is proportionality. Collecting more data can theoretically improve screening, but every additional field also creates questions about accuracy, relevance, retention, security and how officials interpret information that may be incomplete or taken out of context. Those questions become particularly significant when information collected for immigration screening includes years of online identities and details about people other than the applicant.
Social Media Screening Creates a Different Kind of Vetting Problem
Social media is particularly difficult to evaluate because online activity is highly contextual. A username can establish an association with an account, but determining what an old post means may require knowledge of language, humor, political context, quotation, sarcasm or whether the account was even controlled by the applicant when particular material appeared.
Automated analysis introduces another layer of complexity. AI and other screening tools can process enormous amounts of information, but classification systems can generate false positives when they encounter ambiguous language, unfamiliar cultural references or incomplete datasets. A security system can therefore become more comprehensive in the amount of data it processes without necessarily becoming proportionately more accurate in the conclusions it produces.
Those limitations do not mean social media has no value in security investigations. Public online activity can provide relevant evidence in individual cases. The policy question is whether mandatory disclosure from millions of ordinary travelers produces enough additional security value to justify the privacy, administrative and error risks created by collecting it at scale.
Privacy Concerns Extend to People Who Are Not Traveling
The family-information provisions broaden the privacy issue beyond the person submitting an ESTA application. Under the proposal, travelers could be asked for information about parents, spouses, siblings and children, including names, residences, birth information and telephone numbers. Those relatives may never have applied for U.S. travel authorization themselves, yet information about them could become part of another person’s screening record.
That creates a network effect in government data collection. Instead of evaluating one traveler solely through passport and application information, authorities can potentially construct a wider map of relationships connecting applicants with family members, previous contact details, business identities and online accounts. Such information can be useful for identity resolution, but it also increases the amount of sensitive personal data that government systems must protect.
Data security therefore becomes inseparable from border security. Large databases containing passports, facial images, contact histories and family relationships can themselves become valuable targets for cybercriminals or hostile intelligence services. Any expansion in collection consequently raises a second question alongside whether the information is useful: how securely it can be stored, accessed and eventually deleted or retained.
The Proposal Could Affect Millions of Travelers
The scale of ESTA makes even relatively small application changes significant. In its December 2025 notice, CBP estimated 14,484,073 annual responses for the ESTA Mobile application and estimated that the expanded process would require approximately 22 minutes per response. A data requirement applied at that scale is fundamentally different from enhanced screening used only for a small group of travelers identified for additional scrutiny.
The Visa Waiver Program includes many of America’s closest allies and major tourism markets. Current ESTA eligibility includes countries across Europe and Asia-Pacific as well as Australia, New Zealand, Israel, Qatar and Chile. Citizens of those countries can generally seek authorization to visit for eligible tourism or business trips of up to 90 days without going through the conventional visitor-visa application process.
That convenience is one of the Visa Waiver Program’s principal benefits. If the information required for an ESTA application becomes substantially more extensive, the practical distinction between simplified visa-free authorization and a more intensive vetting process begins to narrow, even though ESTA remains legally different from obtaining a visa.
The Timing Matters for U.S. Travel and Major Events
The proposal emerged as the United States prepared for an unusually important period of international travel. The country co-hosted the 2026 FIFA World Cup with Canada and Mexico and is preparing to host the 2028 Summer Olympics in Los Angeles, events that place additional attention on how efficiently the United States can process large numbers of legitimate international visitors while maintaining border security.
Stricter screening and tourism are not inherently incompatible, but additional application requirements can create friction. Travelers may need more time to gather historical contact information, understand what social-media identifiers must be disclosed and determine how family information should be entered. The effect becomes more significant when rules apply to millions of people rather than travelers selected individually for enhanced vetting.
For the travel industry, the important metric will therefore be whether stronger data collection materially changes application completion rates, processing times or traveler behavior. Those outcomes should be measured rather than assumed, because a requirement that appears minor on an individual form can create meaningful cumulative friction across more than 14 million annual applications.
Previous Attempts to Make ESTA Social Media Mandatory Faced Resistance
The administrative history also complicates any assumption that the December 2025 proposal automatically represents the final form of ESTA screening. CBP previously sought to make social-media identifiers mandatory, but an Office of Management and Budget review resulted in the agency keeping the information optional. OMB’s 2023 conclusion explicitly stated that CBP had removed social-media identifiers as a required field following review.
The latest proposal therefore revisits a policy question that federal officials have already debated. Privacy and civil-liberties organizations responded to the 2025 notice by arguing that mandatory social-media disclosure could chill expression, sweep in information about third parties and produce limited security benefits relative to the scale of collection. Those objections do not determine what policy the government ultimately adopts, but they are relevant to understanding why administrative review matters.
This is also why travelers should distinguish policy reporting from practical travel instructions. A Federal Register notice can describe what an agency proposes to collect, while the live ESTA application determines what an applicant is actually being asked to provide at a particular time. For travel decisions, the operational government system should take precedence over older news reports about proposed requirements.
What Travelers Should Take From the U.S. Proposal
The most important correction to the original story is that the U.S. initiative is not simply a “five-year social-media history check for visitors from 40 countries.” It is a broader proposed redesign of ESTA data collection affecting Visa Waiver Program travelers, combining online identifiers with historical contact information, family details, stronger identity verification and potentially expanded biometrics.
It is equally important not to overstate the proposal. The December 2025 notice does not justify telling travelers that every person using ESTA must hand over five years of posts, passwords, DNA and iris scans. CBP specifically described social media as a mandatory proposed data element, while several additional “high value” fields were to be added when feasible, and the notice itself formed part of an administrative information-collection process.
The broader significance lies in the direction of U.S. border technology. Travel authorization is evolving from a relatively conventional form-based screening process toward one that can combine passports, live facial verification, electronic passport chips, historical digital identifiers and increasingly large collections of personal data.
That may give border agencies more information with which to verify identities and investigate threats, but it also creates a larger privacy and cybersecurity responsibility. The central question is therefore no longer simply whether U.S. authorities should examine social media. It is how much digital history a government should collect from millions of low-risk travelers, how reliably that information improves security and what safeguards should govern the resulting data.
