U.S. expands data‑collection rules to Visa Waiver travelers
Washington – The Department of Homeland Security’s Customs and Border Protection (CBP) has issued a notice in the Federal Register proposing that travelers from the 40‑plus countries that participate in the Visa Waiver Program (VWP) disclose five years of social‑media activity, a decade of email addresses, and extensive family‑background information before they can obtain travel authorization through the Electronic System for Travel Authorization (ESTA). The proposal follows an executive order signed by President Donald Trump in January 2025 that mandates “enhanced screening” of all persons entering the United States for national‑security reasons.
The draft rule would require applicants to make every social‑media account public for “comprehensive and thorough vetting,” a language echoed in a June 18 internal State Department cable that instructed consular officers to look for “hostility toward the citizens, culture, government, institutions, or founding principles of the United States” in visa‑related cases — as reported by Reuters. While the requirement has previously applied only to non‑immigrant visa applicants (F, M and J categories), the new rule would extend it to VWP travelers who previously faced only the brief ESTA questionnaire that asks for basic biographic data such as parents’ names and current email address.
Geopolitical context and economic stakes
The VWP includes nations such as Japan, South Korea, Germany, and New Zealand, accounting for roughly 85 % of pre‑pandemic tourism to the United States. International visitors generated an estimated $172 billion in spending in 2023, according to the U.S. Travel Association, supporting millions of jobs in hospitality, retail, and transportation. Extending intrusive data‑collection to these travelers could therefore have a measurable impact on U.S. tourism revenues and on bilateral relations with allied democracies that view the measure as an “unprecedented intrusion on privacy.”
Analysts note that the move aligns with a broader Trump‑era push to scrutinize foreign students and scholars—a policy that has already forced applicants for F‑type student visas to unlock their social‑media profiles, as detailed by the Guardian. The administration argues that the same logic applies to short‑term visitors, whom it says could be “used as vectors for extremist propaganda or covert influence operations.”
Legal and civil‑rights challenges
Immigration‑rights groups and civil‑liberties advocates have warned that the expanded vetting could contravene First‑Amendment protections and international privacy norms. The American Civil Liberties Union (ACLU) has filed a statement with the Federal Register comment period, urging the agency to clarify the criteria for “hostility” and to provide transparent safeguards against arbitrary denials. The public has 60 days to submit comments, a window that will likely see a surge of input from tech firms, privacy experts, and foreign embassies.
Legal precedent exists for requiring social‑media disclosure from visa applicants. U.S. Citizenship and Immigration Services (USCIS) already screens green‑card applicants for “endorsing, promoting, or supporting anti‑American, terrorist or antisemitic views,” a practice that survived challenges in the courts during the previous administration. Extending the same requirement to VWP travelers, however, may test the limits of judicial deference, given that VWP participants previously enjoyed a streamlined, low‑burden entry process.
International reaction
European Union officials have expressed “concern” that the policy could undermine the reciprocal travel arrangements that underpin the transatlantic relationship. In a brief statement, the European Commission’s Directorate‑General for Migration and Home Affairs said that any “disproportionate data‑collection” could trigger “a review of the Visa Waiver Program’s eligibility criteria.” Similar sentiments have been echoed by Japan’s Ministry of Foreign Affairs, which indicated it would consult with Washington to ensure that the new rules do not violate existing bilateral agreements.
What comes next
If the rule survives the comment period, CBP is expected to implement it within the next few months, with a requirement that all ESTA applications submitted after the effective date include the expanded data fields. Consular officers will have five business days to complete the “online‑presence” review, according to the June 18 cable, potentially delaying travel for millions of tourists and business travelers.
Stakeholders are watching closely to see whether the United States will adjust the scope of the request in response to domestic and foreign pressure or whether it will proceed, setting a new standard for entry‑screening worldwide. The outcome will shape not only the dynamics of U.S. tourism but also the broader debate over how democratic societies balance security imperatives with individual privacy rights.
