U.S. Customs and Border Protection has unveiled changes to the Electronic System for Travel Authorization that would expand the personal information required from millions of foreign visitors seeking visa-free entry to the United States, according to a Federal Register notice published December 10.

The proposed revisions would make social media disclosure mandatory for travelers from 42 countries participating in the Visa Waiver Program, while also requiring extensive family history, biometric data, and transitioning the entire application process to a mobile-only platform.

Under the proposal, ESTA applicants would be required to provide their social media accounts from the past five years as a mandatory data element, marking a significant shift from the current optional disclosure. Since 2016, applicants could voluntarily list their social media accounts, but the question remained optional with no negative inference for non-response.​​

The change stems from Executive Order 14161, issued in January 2025 and titled “Protecting the United States From Foreign Terrorists and Other National Security and Public Safety Threats.” The order directs federal agencies to implement enhanced vetting standards and collect additional information from individuals seeking admission to the United States.​​

CBP justifies the requirement as necessary for identity verification and national security screening, stating the information would help “determine whether such grant of a benefit poses a security or public-safety threat to the United States.”

Beyond social media, CBP plans to add several “high value data fields” to ESTA applications when feasible, including:​​

• Telephone numbers used in the past five years
• Email addresses used in the past ten years
• IP addresses and metadata from electronically submitted photos
• Family member names, including parents, spouse, siblings, and children
• Family members’ telephone numbers used in the past five years
• Family members’ dates of birth, places of birth, and residencies
• Business telephone numbers used in the past five years
• Business email addresses used in the past ten years
• Biometric information, including face, fingerprint, DNA, and iris scans

The inclusion of DNA as a potential data element has sparked particular concern among privacy advocates and immigration experts.

CBP also intends to decommission the ESTA website application process and require all new applications be submitted through the ESTA Mobile application. The ESTA website would remain available as an information resource and for checking application status, but not for submitting new applications.

The mobile application provides identity verification through liveness detection, facial recognition, and Near Field Communication-based passport scanning that can verify electronic chip authenticity. Unlike the website, the mobile app can retrieve biographic information and portrait photos from passport e-chips and automatically deny applications that fail Country Signing Certificate validation.

CBP is implementing a new Voluntary Self-Reported Exit pilot through the CBP Home mobile application, allowing foreign nationals subject to I-94 requirements to voluntarily provide evidence of their departure from the United States.​​

The VSRE pilot, which launched earlier in 2025, requires participants to submit biographic data from their passports or travel documents, facial images, and geolocation information. While use of the functionality is optional, submitting a facial image is required if travelers choose to participate.​​

CBP will use geolocation services to confirm the traveler is outside the United States and run “liveness detection” software to determine the selfie is a live photo rather than a previously uploaded image. The mobile application will compare the facial image to facial images already retained by CBP to confirm the exit biometrically.​​

Confirmed departures will be recorded in the Arrival and Departure Information System maintained by CBP. The technology provides travelers with proof of departure, which is particularly relevant at land borders, and can help resolve alleged overstays or missing exit records.

The public has 60 days from the December 10 Federal Register publication to submit comments on the proposed changes, with the deadline falling on February 9, 2026. Comments must include OMB Control Number 1651-0111 in the subject line and should be submitted to CBP_PRA@cbp.dhs.gov.