US Customs and Border Protection to Tighten ESTA Rules for Visa Waiver Program Travelers remains a live issue in 2026, but the stricter requirements are not in effect yet. If finalized, the proposal would force Visa Waiver Program travelers to give far more personal data in ESTA, while a separate U.S.-EU data-sharing debate could shape future visa-free travel rules.
If you use ESTA, you are affected before you even board a flight or ship to the United States. That includes travelers from Visa Waiver Program countries across Europe, Asia, Oceania, and the Middle East who rely on fast, visa-free entry for business or tourism stays of up to 90 days.
What ESTA travelers need to know right now
U.S. Customs and Border Protection published a Federal Register notice on December 10, 2025 proposing a major expansion of ESTA and related arrival and departure data collection. The public comment period closed on February 9, 2026. CBP has not announced a final rule or an effective date.
That means current ESTA requirements remain in place for now. You do not need to submit the proposed extra data unless CBP finalizes the rule and sets an implementation date.
Still, the proposal shows where U.S. screening is heading. It points to more identity checks, more history checks, and more data pulled together before you travel.
ESTA sits at the center of the Visa Waiver Program. It is the online travel authorization used by eligible travelers who visit the United States without first getting a B-1/B-2 visitor visa. ESTA is not a visa. An approved ESTA only allows you to travel to a U.S. port of entry and ask for admission. A CBP officer still decides whether you enter.
What CBP wants to add to ESTA if the rule is finalized
CBP’s proposal would turn ESTA into a much more detailed screening tool. Some of the new fields focus on identity. Others reach into your personal history, family background, and online presence.
Proposed ESTA disclosures: what you would need to provide
- Social media account names or identifiers from the past 5 years
- Phone numbers from the past 5 years
- Email addresses from the past 10 years
- Family information, including birth dates, places of residence, and birthplaces for certain family members as requested
- Employment history covering past years listed in the proposal
- Residential address history covering past years listed in the proposal
- Travel history
- IP addresses and metadata
- A photo upload, including a selfie matched against the passport biographical page photo
CBP also described certain fields as “high value data fields.” Those include long-term contact history and technical identifiers that go beyond the basic traveler details people expect in ESTA today.
One of the biggest changes is social media disclosure. Under the proposal, ESTA applicants would have to provide social media identifiers used over the past 5 years. CBP would not ask for passwords or account access. The proposal says not all accounts would be checked.
The proposal also reaches deeper into contact history. Travelers would have to provide phone numbers used in the past 5 years and email addresses used in the past 10 years. For some contact details, CBP used a “where possible” qualifier. That matters if you changed numbers often or no longer remember older accounts.
Family information is another major area. CBP wants birth dates, birthplaces, and places of residence for family members in categories requested on the form. That data can help officers compare records and resolve identity questions.
The agency also proposed collecting biometric information when feasible, including facial images and, in some contexts, fingerprints, DNA, or iris scans. That does not mean every ESTA applicant will suddenly submit all of those items through the normal online form. It does show the government’s broader push toward biometric screening across travel systems.
Why CBP says ESTA needs more data
CBP presented the changes as part of stricter vetting and stronger identity verification. The proposal aligns with a broader security push tied to Executive Order 14161, issued in January 2025, and with President Donald Trump’s tougher migration and border policies.
The practical effect is clear. ESTA is moving away from a short pre-travel screen and toward something that looks more like a light visa process.
Rosanna Berardi, Esq., of Berardi Immigration Law, explained the shift this way: “Travelers are right to ask whether ESTA is becoming more like a visa application. The answer is: not yet, but the distance between them is shrinking.”
That is important for families, business travelers, and frequent visitors. A longer form means more time spent gathering records. It also means a higher risk of mistakes, mismatched dates, or inconsistent spellings.
How these changes would affect your trip planning
If CBP finalizes the proposal, travel under ESTA becomes more document-heavy. You would need to prepare earlier and keep more personal records organized.
What this means before you apply
- Gather old phone numbers and long-used email accounts
- Check exact name spellings across your passport, prior visas, and old travel records
- Confirm family birth details and places of residence before starting the form
- Review your social media handles from the past 5 years
- Allow more time for processing and possible follow-up screening
A good step is to build a personal travel identity file. Keep your current and prior phone numbers, long-used email addresses, address history, and the exact spellings you have used in official records. Use the same details across bookings and government forms.
Consistency matters. A small mismatch in a passport number, name order, or prior address can trigger extra review.
You should also keep notes if you cannot remember an older number or account. If a field does not apply or you cannot fully reconstruct past contact details, write down what you checked and why. Save those notes with your travel records.
Even with an approved ESTA, you are not guaranteed entry. If your passport details, name spelling, or prior travel history differ across records, you should expect more questions at the port of entry. Carry proof of return or onward travel and a clear itinerary showing your temporary plans.
The U.S.-EU data-sharing debate adds another layer of uncertainty
A separate issue is also shaping the future of visa-free travel. The United States has been asking Visa Waiver Program countries to conclude Enhanced Border Security Partnership arrangements with the Department of Homeland Security.
In Europe, this has triggered concern because personal data protection is treated as a fundamental right. Large-scale transfers of biometric or border-related information to a third country raise legal and political questions.
What the Enhanced Border Security Partnership means
The European Commission described the Enhanced Border Security Partnership, or EBSP, as a U.S. requirement for countries that are already in the Visa Waiver Program or want to join it. The Commission’s 2025 recommendation states that the United States introduced this requirement in 2022 and expects EBSP agreements to be concluded by December 31, 2026.
After that date, the Department of Homeland Security would assess compliance when deciding whether a country should continue in the Visa Waiver Program or join it.
The possible information exchange is broad. It can cover:
- Travelers to the United States connected to a Visa Waiver Program partner country
- Applicants for immigration benefits or humanitarian protection in the United States
- People encountered by DHS law enforcement in a border or immigration setting
- Biometric data stored in EU member-state national databases
This is why the debate matters. It is not just about passports. It reaches into fingerprints, identity records, immigration-linked information, and access to national databases.
Why Europe is pushing for strict privacy safeguards
The European Parliament’s research service has said that the EU-U.S. framework under negotiation would set general rules for member states to negotiate access to national databases with U.S. authorities. It also noted that any agreement would require approval by both the European Parliament and the Council.
The European Data Protection Supervisor has warned that any transfer of personal data to the United States must include strong safeguards. The EDPS said the agreement could become the first EU agreement involving large-scale sharing of personal data, including biometric data such as fingerprints, for border and immigration control by a third country.
The EDPS called for strict necessity and proportionality, along with clear limits on scope, transparency duties, accountability measures, and judicial redress.
For you as a traveler, this means one thing: visa-free travel is becoming more data-driven. The legal fight is not abstract. It can affect future ESTA checks and what governments must share to keep Visa Waiver Program access.
Could travelers lose Visa Waiver Program access?
There is no immediate cancellation of visa-free travel for EU citizens as a group. Travelers from participating countries still use ESTA under the current rules unless nationality-specific restrictions apply.
But visa-free travel is not unconditional. The United States can change ESTA screening rules, demand more data, and reassess whether a country remains eligible for the Visa Waiver Program.
The European Commission directly linked EBSP compliance to continued participation after December 31, 2026. That does not mean every European traveler is about to lose visa-free access. It does mean your country’s status depends in part on security and data-sharing cooperation with DHS.
A future breakdown would not automatically end the entire program at once. It could lead to country-specific consequences, tighter screening, or pressure on governments to complete bilateral arrangements inside an EU-wide framework.
Who can still use ESTA and how the program works
The Visa Waiver Program currently covers 42 countries as of late 2025. It includes most European Union member states, the United Kingdom, Australia, New Zealand, Japan, South Korea, Singapore, Qatar, and others on the U.S. State Department list.
Bulgaria, Cyprus, and Romania are not on the current State Department Visa Waiver Program country list. CBP’s December 2025 notice reflects Romania’s removal from the program.
If you travel under the Visa Waiver Program, these basic rules still apply:
- You can visit for tourism or business
- You can stay for up to 90 days
- You must get ESTA approval before boarding a U.S.-bound air or sea carrier
- You generally cannot extend your stay beyond the period of admission
- You waive most removal rights, except asylum-related protections
Land travelers entering from Canada or Mexico have needed ESTA since May 2, 2022.
Frequent travelers and people with more complex travel histories sometimes choose a B-1/B-2 visa instead of relying on ESTA. That route takes longer, but it can offer more stability when screening rules tighten.
Other U.S. entry restrictions already changed travel in 2026
While the ESTA proposal is still pending, a separate presidential proclamation already changed entry rules for many nationalities. President Donald Trump signed the proclamation on December 16, 2025, and it took effect on January 1, 2026.
Countries subject to a full entry ban
The proclamation fully bans entry for nationals of 20 countries:
- Afghanistan
- Burkina Faso
- Burma
- Chad
- Republic of the Congo
- Equatorial Guinea
- Eritrea
- Haiti
- Iran
- Laos
- Libya
- Mali
- Niger
- Sierra Leone
- Somalia
- South Sudan
- Sudan
- Syria
- Yemen
The proclamation also applies to people traveling on Palestinian Authority documents.
Countries subject to partial visa bans
The same proclamation partially bans B-1/B-2/F/M/J visas for nationals of 18 countries:
- Angola
- Antigua and Barbuda
- Benin
- Burundi
- Cote d’Ivoire
- Cuba
- Dominica
- Gabon
- The Gambia
- Malawi
- Mauritania
- Nigeria
- Senegal
- Tanzania
- Togo
- Tonga
- Venezuela
- Zambia
- Zimbabwe
The proclamation also targets immigrant entry for Turkmenistan nationals.
These restrictions work differently from ESTA. ESTA changes affect how Visa Waiver Program travelers are screened. Presidential proclamations can block or limit entry by nationality or visa category regardless of ESTA procedures.
What you should do before your next U.S. trip
If you plan to travel under ESTA in 2026, treat pre-travel screening more seriously than before. The system is not final yet, but the direction is clear.
- Check your ESTA status and nationality eligibility before booking.
- Apply at least 72 hours before departure, and earlier if your travel history is complex.
- Gather old contact details, exact passport data, and family identity information now.
- Keep your itinerary flexible in case screening rules change or processing slows.
- Watch for official updates from CBP, DHS, ESTA, the U.S. State Department, the European Commission, and your national government.
The next major deadline in the wider data-sharing debate is December 31, 2026, when DHS expects Enhanced Border Security Partnership agreements to be concluded for Visa Waiver Program assessment. Before that, CBP can still review the comments filed by February 9, 2026, revise the ESTA proposal, and issue a final rule with a future effective date.
For now, current ESTA rules still apply. But if you depend on visa-free travel to the United States, this is the time to get your records in order and follow every official update closely.
