Immigration

United States |  CBP announces proposed significant data collection changes to ESTA application process

Summary

US Customs and Border Protection (CBP) is proposing changes to the Electronic System for Travel Authorization (ESTA) application process and is seeking public comment. These changes include social media review, I-94 automation using facial recognition software and geolocation, mandatory disclosure of “high value data”, and transitioning solely to a mobile application platform. The changes are anticipated to go into effect shortly after the 60-day comment window closes.

The detail

On December 10, 2025, CBP published a notice in the Federal Register (FR) setting forth proposed changes to the ESTA application used by business visitors and tourists entering the United States under the Visa Waiver Program (VWP.) The public may submit comments on the proposed changes during the 60-day comment window, ending on February 9, 2026. CBP is proposing to make the following changes:

• I-94 automation pilot using facial recognition and geolocation: CBP proposes implementing a new functionality within the CBP Home mobile application to allow individuals subject to I-94 requirements to voluntarily provide biographic data from their passport, facial images, and geolocation as evidence of their departure from the US. While the use of the functionality will be optional, submitting a facial image is required.  “Liveness detection” software will be utilized on the facial image to determine the photo is a live photo rather than a previously uploaded photo. CBP states that the collection of this data is critical to fulfill the Department of Homeland Security (DHS) mandate to collect biometric data when individuals depart the US, assists in the goal to fully automate I-94 information collection, and will provide more accurate exit records.
• Mandatory photo upload: CBP plans to update the ESTA application website to require applicants or the third-party making the application on behalf of the applicant (e.g., travel agents, family members, etc.) to provide a photograph of the applicant’s face in addition to a photo of the passport biographic page. Liveness detection software will be applied to verify the image is a life photo instead of a previously uploaded one.
• Replace ESTA website with a mobile application: CBP will decommission the current ESTA website application process and designate the ESTA mobile application—which is able to validate authenticity of passports through certificates on the e-Chip.—as the sole platform to apply for a new ESTA.
• Mandatory social media disclosure: CBP proposes a mandatory disclosure of social media accounts from the last 5 years to comply with the January 2025 Executive Order 114161, Protecting the United States from Foreign Terrorists and Other National Security and Public Safety Threats.
• Additional data collection: In addition to the information already collected in the ESTA application, the application will also require “high value data element” fields be completed, including: (1) telephone numbers, both personal and business, used in the last 5 years, (2) email addresses, both personal and business,  used in the last 10 years, (3) IP addresses and metadata from electronically submitted photos, (4) names of family members (parents, spouse, siblings, children), (5) phone numbers used by family members in the last 5 years, (6) dates of and places of birth for family members, and (7) biometrics (facial imaging, fingerprints, DNA, and iris scan).

The impact

After the closure of the public comment period ending on February 9, 2026, it is anticipated the proposed changes to the ESTA application process will take effect in stages over the subsequent weeks and months. If implemented, applicants will be required to provide the additional personal data, this could result in longer processing times for ESTA approvals.

Vialto will continue to monitor the process and will provide further information as it becomes available.

Contact us

For a deeper discussion on the above, please reach out to your Vialto Partners point of contact, or alternatively:

Manish Daftari
Partner

Want to know when a Regional Alert is posted?

Simply follow our Vialto Alerts page on LinkedIn and posts will be displayed on your feed. To ensure you don’t miss one, once you’re on our LinkedIn page, click on the bell icon under the banner image to manage your notifications.

Further information on Vialto Partners can be found here: www.vialtopartners.com

Vialto Partners (“Vialto”) refers to wholly owned subsidiaries of CD&R Galaxy UK OpCo Limited as well as the other members of the Vialto Partners global network. The information contained in this document is for general guidance on matters of interest only. Vialto is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information is provided “as is”, with no guarantee of completeness, accuracy, timeliness or of the results obtained from the use of this information, and without warranty of any kind, express or implied, including, but not limited to warranties of performance, merchantability and fitness for a particular purpose. In no event will Vialto, its related entities, or the agents or employees thereof be liable to you or anyone else for any decision made or action taken in reliance on the information in this document or for any consequential, special or similar damages, even if advised of the possibility of such damages.

© 2025 Vialto Partners. All rights reserved.