(UNITED STATES) — Senators Edward Markey and Ron Wyden sent a letter on February 13, 2026, urging U.S. Customs and Border Protection to abandon a proposed rule that would require Visa Waiver Program travelers to disclose years of social media activity on ESTA applications.
The Democrats, Markey of Massachusetts and Wyden of Oregon, addressed the letter to CBP Commissioner Rodney Scott as the agency weighs a draft rule that would expand current screening questions into mandatory disclosures for visitors entering under the Visa Waiver Program, or VWP.
Under the proposed change, travelers who now use the Electronic System for Travel Authorization, known as ESTA, would face a new requirement to provide five years of social media handles, posts, and direct messages as part of the online authorization process. The VWP lets eligible visitors travel to the United States for short stays without first obtaining a visa, and ESTA applications serve as the pre-travel authorization step many VWP travelers complete before boarding.
In practice, “social media disclosure” would mean giving the U.S. government identifiers tied to online accounts and, under the proposal described by the senators, potentially far more than just account names. The information contemplated goes beyond handles on major platforms and extends to the substance of what travelers wrote and shared, as well as the content of private communications.
CBP posted the draft rule on the Federal Register last month. It would apply to visitors from 42 VWP countries, mostly in Europe, and would turn optional questions into required disclosures covering platforms like Facebook, Instagram, Twitter, and YouTube.
Beyond social media, the proposal also considers requiring 10 years of email addresses. It further considers requiring details on immediate family members, including names, birth dates, residences, and birthplaces.
Markey and Wyden framed that broader set of requests as an escalation in digital screening that they said would reach well beyond what many travelers expect when they apply for ESTA authorization. They warned that the policy would sweep up information about travelers’ online identities, their communications, and sensitive family links in a single intake process.
The senators argued that the proposal enables “sweeping digital surveillance,” chills free speech, invites profiling, and burdens CBP with unmanageable data. They also said it lacks clear protocols for storage, security, or deletion and could run into transatlantic privacy commitments, including the EU-U.S. Data Privacy Framework.
“By requiring travelers to disclose their personal social media information, CBP will force people who simply want to visit family in the United States, conduct business with U.S. companies, or attend events. to submit to sweeping digital surveillance,” the senators wrote.
Markey and Wyden also cast the issue as one of reciprocity and expectations among U.S. allies. They said Americans would object to similar demands from allies like Great Britain, France, or Australia.
The political pushback targets a rulemaking process controlled by executive agencies, not Congress. CBP, part of the Department of Homeland Security, would determine whether to finalize the proposal after receiving public comment, and only the agency can decide whether to rewrite, narrow, delay, or adopt the rule.
Still, lawmakers can shape the path by pressing agencies for explanations and documents and by calling officials to testify. The senators’ letter sought to raise the costs of moving ahead, warning that the combination of broad collection and unclear safeguards could create legal and operational problems that extend beyond the initial screening goal.
The dispute also sits at the intersection of U.S. vetting policy and cross-border privacy frameworks, which have become an increasingly sensitive point with allied countries. Markey and Wyden referenced the EU-U.S. Data Privacy Framework as they argued the proposal could conflict with expectations about how personal data gets collected, retained, and protected when it crosses borders.
Industry groups warned that the rule could carry economic consequences if travelers view the new requirement as intrusive or time-consuming. Business groups, including the U.S. Travel Association, said it could deter executives from Europe and Japan and diverting billions in tourism spending.
The proposal’s supporters and critics diverge on what additional social media data would accomplish at the border. Privacy advocates and the Brennan Center pointed to what they described as limited security benefits, citing DHS’s own 2016 tests showing social media yielded no clear national security links in most refugee vetting cases.
Those organizations also raised concerns about how social media information gets interpreted at scale. They flagged the risk that automated tools, or personnel relying on large volumes of online material, could mistakenly associate a person with troubling content or misunderstand context.
In this setting, “algorithmic false positives” refers to errors where screening systems or processes misidentify risks that are not real. That can happen when a name, handle, or language pattern resembles another person’s, or when context gets lost in translation, sarcasm, slang, or fragmented excerpts pulled from longer conversations.
Advocates argued those errors could ripple into the travel experience. They warned that increased data collection could slow processing and contribute to airport delays, including more travelers being routed to secondary screening, even if the intent is to improve vetting.
CBP faces a practical challenge embedded in the senators’ critique: collecting large quantities of social media material does not automatically translate into usable leads. Markey and Wyden argued the data volume itself could become unmanageable, raising the risk that important information gets buried or that agencies default to overly broad screening rules.
The draft rule’s scope also matters because VWP travel differs from visa processing. ESTA authorization is used by VWP travelers as a pre-boarding step, while visa applications involve a separate process that can include interviews and additional documentation. Disclosure rules can differ between those systems, and travelers who are familiar with visa requirements may not expect similar obligations to be attached to visa-free travel.
Social media disclosure already plays a role in parts of the visa system. Since 2019, social media disclosure has been required for immigrant and non-immigrant visas, with recent H-1B applicants needing public privacy settings.
That existing visa practice helps explain why the proposed VWP change draws heightened attention. ESTA applications reach travelers who use the Visa Waiver Program precisely to avoid the time and friction of applying for a visa, and the senators and industry groups warned that adding a broad digital disclosure requirement could erode that advantage.
The proposal stems from a January 2025 Trump executive order mandating maximum vetting of visitors. DHS and CBP have treated that direction as a basis for expanding information requests, and the new draft rule would formalize what the senators described as an enlarged digital intake for VWP travelers.
Under the standard federal rulemaking process, agencies publish a proposed rule, take public comment, and then decide whether to revise and publish a final rule with an effective date. CBP posted the proposal last month, and Markey and Wyden urged the agency to pull it back rather than refine it.
If the rule becomes final after public comment, it could take effect in late 2026. Until then, the requirement remains proposed, and travelers’ obligations do not change unless and until the government formally implements new ESTA questions or requirements.
That distinction matters for travelers planning trips. A proposal signals what the government wants to require, but it does not itself impose a new obligation until an agency completes the process and sets the terms that apply at the time of travel.
In their letter, Markey and Wyden focused on what they said were unresolved questions about data handling. They argued the proposal lacks clear protocols on where the information would be stored, how it would be secured, who would access it, and when it would be deleted.
Those questions are central to privacy concerns because large datasets can be shared across offices and retained for long periods, and because the risks from misuse, mistaken access, or breaches increase with the amount of sensitive material collected. The senators linked that uncertainty to broader data-privacy friction with allied countries and to the EU-U.S. Data Privacy Framework, which they cited as potentially implicated.
The letter also raised a civil liberties argument tied to speech. Markey and Wyden said the requirement could chill free speech by encouraging travelers to avoid discussing politics or sensitive topics online, or by dissuading them from traveling at all if they fear their posts and messages will be scrutinized or misunderstood.
Business groups stressed a different risk: competitiveness and travel demand. The U.S. Travel Association warned that executives from Europe and Japan could choose other destinations, pushing tourism and business travel spending elsewhere.
Supporters of expanded vetting argue that more information helps screen for security threats, but the organizations opposing the draft rule said the tradeoff becomes harder to justify when agencies cannot show clear benefit and when the data may be noisy or misleading. The Brennan Center and other privacy advocates pointed to DHS’s 2016 tests as evidence that social media screening may not reliably surface national security links in many cases.
The senators’ letter adds pressure that could translate into congressional oversight activity, including hearings or formal information requests. Congress cannot directly finalize or withdraw the rule on its own, but sustained oversight can force agencies to explain the purpose, limits, and safeguards of a proposal in public and can shape how aggressively an agency proceeds.
For travelers, the practical next step is monitoring what CBP and DHS do with the proposal as the comment process unfolds. Key signals include whether CBP narrows the kinds of information it requests, whether it limits the time period covered, and whether it answers questions about retention, access, sharing, and deletion in the final rule’s documentation.
Travelers weighing near-term trips under the Visa Waiver Program may also pay attention to how the agency describes any future ESTA changes, because the rule’s most immediate effect would be to add or expand mandatory questions in ESTA applications. With the proposal still pending, travelers can avoid surprises by checking current ESTA requirements before each trip and watching for official updates as the timeline toward late 2026 approaches.
