The U.S. Customs and Border Protection (CBP) has announced sweeping proposed changes to its traveller screening systems, including a new mandatory social-media disclosure requirement for all ESTA applicants. The updates, published this week in the Federal Register, form part of a broader revision of the information collected under the Arrival/Departure Record (Form I-94) and the Electronic System for Travel Authorization (ESTA).
Social Media Becomes Mandatory for ESTA Applicants
A key change—likely to draw the most public attention—is the introduction of a compulsory social-media screening component. Under the January 2025 U.S. Executive Order 14161, all ESTA applicants will now be required to provide five years’ worth of their social-media accounts. This marks a major expansion of the data collected from travellers under the Visa Waiver Program.
The move formalises what had previously been an optional field and reflects Washington’s push to strengthen national-security vetting by examining online footprints. CBP states that the addition of social-media identifiers is intended to help identify potential security risks and detect fraudulent identities.
Shift Toward Biometric Identity Verification
The mandatory social-media requirement comes as part of a much larger package of changes aimed at modernising and tightening U.S. border controls.
Highlights include:
- Voluntary Self-Reported Exit (VSRE) via Mobile App
Travellers subject to I-94 requirements will soon be able to self-report their departure from the United States using the CBP Home mobile application. Although optional, the VSRE process requires a mandatory live selfie and geolocation data to biometrically confirm the exit.
2. ESTA to Become Mobile-Only
CBP plans to decommission the ESTA website application system, forcing all new ESTA applications to be filed exclusively via the ESTA Mobile app.
The agency cites security weaknesses in the website process, such as poor-quality passport photo uploads and the inability to verify e-passport chips. Fraudulent third-party websites exploiting the system were also a key factor behind the decision.
3. Additional “High-Value” Data Fields
To comply with new federal directives, CBP will significantly expand the range of information collected from travellers. New data fields include:
- Phone numbers (past 5 years)
- Email addresses (past 10 years)
- IP addresses and photo metadata
- Detailed family-member information
- Biometrics including facial images, fingerprints, DNA, and iris scans
- Historical business contact information
Other Notable Updates
Romania will be removed from the Visa Waiver Program, and the forms will be updated accordingly.
CBP is revising its burden estimates to account for possible new VWP countries and recent additions such as Qatar.
Public Consultation Open Until 9 February 2026
CBP is inviting comments on the entire set of proposed revisions, including concerns about privacy, accuracy of burden estimates, and suggestions to reduce the impact on travellers.
Comments must reference OMB Control Number 1651-0111 and be submitted by email to CBP_PRA@cbp.dhs.gov