The United States is moving to dramatically expand the amount of personal data it gathers from millions of foreign visitors, under a Trump administration proposal that would make detailed checks of social media activity and family information a standard condition of entry. The plan, set out in a notice from US Customs and Border Protection (CBP) and the Department of Homeland Security (DHS), would require most travellers using the visa-waiver system to hand over five years of social media history along with a decade of email addresses and other contact details before boarding a flight.
The proposed rule targets people who currently use the Electronic System for Travel Authorization, or ESTA, which allows citizens of 42 mainly European and allied countries to visit the US without obtaining a full visa for trips of up to 90 days. Under the changes, the social media field on the ESTA form, which has been voluntary since 2016, would become mandatory. Applicants would be required to list every social platform they have used in the last five years, together with the associated usernames or “identifiers”, giving US authorities routine access to a vast archive of posts, comments and interactions.
The new rules would not only apply to social media. CBP is also proposing to collect all telephone numbers used by an applicant in the previous five years, email addresses used over the last ten years, IP addresses and metadata associated with photos uploaded as part of the application, and extensive information about close family members, including their names, dates and places of birth, contact details and residential addresses. The notice further indicates that biometric data such as facial images, fingerprints, DNA samples and iris scans may be incorporated when “operationally feasible”, signalling a shift towards far more intrusive digital and physical screening at the border.
Officials justify the move as a response to what they describe as evolving security threats and the need to close perceived gaps in vetting visitors. In its Federal Register filing, CBP calls the new data fields “high value” elements that will help officers “confirm a traveller’s identity, assess risk and detect potential national security concerns” before a passenger reaches US soil. The agency has opened a 60-day public comment period, a standard step in US rule-making, after which it could revise the proposal before issuing a final rule that might come into force as early as 2026.
The plan builds on earlier efforts to introduce social media checks into American immigration procedures. Since 2019, most people applying for US visas at embassies and consulates have been required to disclose five years of social media identifiers as part of their paperwork. Extending that obligation from visa applicants to tourists using the visa-waiver system would turn what was previously targeted screening into a default requirement for a far larger population of short-stay visitors, including tourists, business travellers and those visiting family.
Rights groups have long warned that such broad trawling of social media risks misreading jokes, political opinions or casual comments as security threats, particularly when posts are taken out of context or translated by automated tools. Civil liberties advocates also argue that the knowledge that a government official might scrutinise years of online activity will deter people from speaking freely. In earlier responses to similar initiatives, the American Civil Liberties Union said the mass collection of social media data on visa applicants was “deeply problematic” and likely to chill freedom of speech and association among both immigrants and US citizens who interact with them online.
The scope of the new proposal is significant. Citizens of the United Kingdom, Ireland and most European Union member states, along with travellers from countries such as Australia, Japan, South Korea and Israel, currently rely on ESTA for short visits. According to figures cited in coverage of the Federal Register notice, around 40 million trips were made to the US under the visa-waiver scheme in 2019 alone. Millions of those travellers would, under the new rules, be required to disclose their social media activity or face being turned away at the point of application. Canadian citizens, who enter the US under different arrangements, would not be affected.
The timing of the overhaul means the new checks could coincide with major international events on American soil, including the 2026 men’s football World Cup and the 2028 Olympic Games in Los Angeles. Tourism analysts note that the US is already facing competition from other destinations for post-pandemic travel, and that previous immigration measures and political rhetoric have contributed to a fall in international visitor numbers during Donald Trump’s first term. One analysis of travel data found that trips from countries targeted by earlier restrictions fell sharply after he entered the White House, contributing to what some industry figures labelled a “Trump slump” in tourism.
The proposed rule sits within a much wider set of immigration and border enforcement priorities pursued by Trump across both his first and current terms. On returning to office, he signed an executive order instructing agencies to ensure that foreign nationals admitted to the US “do not bear hostile attitudes toward its citizens, culture, government, institutions, or founding principles”. That language has informed efforts to broaden ideological vetting at the border, from expanded questioning of asylum-seekers to closer scrutiny of student and work visas. Social media checks on tourists are being presented internally as another tool to detect those viewed as posing security or public-order risks before they arrive.
Critics question whether such ambitions are realistic. Previous government assessments have struggled to show that mass social media surveillance is an effective way to identify genuine threats, while research has repeatedly highlighted the risk of misinterpretation and the difficulty of spotting sarcasm, coded language or evolving slang. Privacy advocates also warn that once collected, sensitive data about travellers’ political views, religious beliefs or personal relationships could be vulnerable to misuse, data breaches or sharing with other agencies at home and abroad.
The technical design of the new system has also drawn attention. CBP plans to decommission the existing ESTA website and require most new applications to be filed through a mobile app. The app uses facial recognition, “liveness detection” and a chip reader to verify an applicant’s passport, and the agency expects to process around 14 million mobile submissions a year, with each application estimated to take around 22 minutes to complete. The same notice describes a voluntary feature that would use geolocation data and a live selfie to confirm when a traveller has left the United States, further expanding the digital monitoring of visitors throughout their stay.
Reaction on social media has been swift, particularly among football fans and frequent travellers who fear the new checks could complicate plans to attend World Cup matches in 2026 or other sporting events. Under a widely shared Facebook post by youth-focused outlet Tyla, which highlighted the plan as a “strict new rule” for anyone travelling to the US, commenters accused Trump of scaring away tourists and undermining American soft power. One user wrote that the policy meant he had “just told every tourist that was going to America to watch the Football World Cup next year to go to Canada and Mexico”, calling it an “excellent bit of advice”. Another simply declared, “Canada here we come!”, while a third described the United States under such scrutiny as “West Korea”. Those reactions capture a broader worry that tighter entry rules will push some holidaymakers to choose alternative destinations.
Supporters of the plan, including some conservative commentators and former security officials, insist that searching public posts is a reasonable step in an era in which extremist movements, foreign intelligence services and violent lone actors often leave traces of their intentions online. They argue that travellers who are not engaged in criminal or extremist activity have nothing to fear from showing officials their public social media activity. The Trump administration has not yet set out detailed criteria for how posts would be assessed, how far back analysts would look beyond the formal five-year window, or what red lines might automatically trigger refusal of entry.
Beyond tourists, the proposal has implications for people living in the US whose friends and relatives come from overseas. Lawyers point out that requests for information about family members, combined with increased scrutiny of “associations” in the immigration system, could mean that a person’s eligibility to visit is affected by what their relatives or close contacts have said or done online. Those concerns are sharpened for communities that already feel heavily policed, including Muslims, dissidents from authoritarian states and activists who criticise American foreign policy.
There are also questions about reciprocity. Some analysts warn that if the US begins demanding intrusive digital histories from visitors, other governments may respond by imposing similar requirements on American tourists. That could lead to a spiral in which travellers worldwide are routinely required to surrender years of online activity at every border, reshaping expectations of privacy and the norms of international mobility. Others argue that Washington is sufficiently dominant as a destination for business, study and tourism that many people will reluctantly accept the new rules rather than stay away, at least in the short term.
For now, the proposal remains at the consultation stage. During the 60-day comment window, civil liberties organisations, technology companies, travel industry groups and foreign governments are expected to submit formal responses setting out their concerns or support. Once that period closes, CBP will be required to review the submissions and decide whether to modify the plan before issuing a final rule. Legal challenges are likely if the core requirement for mass disclosure of social media histories survives, particularly if opponents argue that it discriminates on the basis of political belief or chills lawful speech.
Until those debates play out, travellers contemplating future trips to the United States are being urged by immigration lawyers to assume that their online lives may become a routine part of the screening process. For many, especially younger visitors whose social interactions have long taken place on public platforms, the idea that a border official could scroll back through years of posts, memes and arguments is a stark illustration of how the balance between privacy and security at international frontiers is shifting in the digital age.