New U.S. Rules for Visa Waiver Travelers: Expanded Data Collection, Mandatory Social Media Disclosure, and What It Means for Millions of Visitors

The United States has introduced significant changes to the information it collects from travelers entering under the Visa Waiver Program (VWP)—a system used by citizens of 40+ countries who can visit the U.S. without a traditional visa for tourism or business.

The revisions, published in the Federal Register on December 10, 2025, update the I-94 Arrival/Departure Record, the Electronic System for Travel Authorization (ESTA), and certain elements of Customs and Border Protection’s (CBP) biometric and screening process.

While the VWP already required basic biographic, passport, and security-related information, this new rule marks a major expansion—most notably through the collection of travelers’ social media identifiers, as well as newly required personal data categories that go far beyond previous norms.

What’s New: Expanded Personal Data and Social Media Requirements

The revised information-collection policy adds several categories that travelers must now provide as part of their entry authorization or arrival record.

The most consequential additions include:

1. Mandatory Disclosure of Social Media Handles

Travelers must now list all social media identifiers used within the past five years on major platforms.

This includes usernames on:

Meta platforms

X/Twitter

YouTube

TikTok

LinkedIn

Instagram

Other identifiable public platforms

CBP states the purpose is to help “identify potential security concerns,” verify identity, and assess whether online behavior raises red-flag indicators.

This goes further than the prior optional disclosure system used in ESTA.

Under the new rule, disclosure is required.

2. New Biographic and Personal Data Categories

The expanded I-94/ESTA data now includes:

• Additional aliases and prior names

• Expanded employment history

• More detailed travel history beyond previous single-country entries

• Comprehensive contact data, including multiple points of contact in home and destination countries

• Information about digital presence, such as websites or non-social media online identities

• Enhanced background questions tied to immigration violations, public-health risks, criminal history, and national-security concerns

3. Broader Access to Third-Party Information

The updated rule authorizes CBP to collect “public-facing information” connected to a traveler’s disclosed digital identity.

In practice, this means:

• Open-source monitoring

• Cross-checking a traveler’s online interactions

• Matching social media data with previous immigration or law-enforcement records

These elements significantly expand U.S. authorities’ ability to assess traveler “risk profiles”.

Why the U.S. Is Expanding Data Collection

CBP argues that modern security threats increasingly involve digital footprints, including online radicalization, foreign influence, and transnational crime coordinated through social platforms.

Officials claim the expanded data is needed to:

• Improve identity verification

• Screen for terrorism and organized-crime risks

• Detect fraudulent or incomplete applications

• Identify inconsistencies with past travel or employment claims

Civil-liberties groups have already raised concerns about First Amendment implications, data-retention practices, and potential overreach.

For now, however, the requirement stands and applies to all VWP travelers.

Who Is Affected: Full List of Visa Waiver Program Countries

Citizens of the following countries must comply with all new requirements, including social media disclosure, when applying for ESTA or entering the U.S.:

Andorra

Australia

Austria

Belgium

Brunei

Chile

Croatia

Czech Republic

Denmark

Estonia

Finland

France

Germany

Greece

Hungary

Iceland

Ireland

Israel

Italy

Japan

Korea (Republic of)

Latvia

Liechtenstein

Lithuania

Luxembourg

Malta

Monaco

Netherlands

New Zealand

Norway

Poland

Portugal

Qatar

San Marino

Singapore

Slovakia

Slovenia

Spain

Sweden

Switzerland

Taiwan

United Kingdom

These countries collectively represent tens of millions of travelers who visit the U.S. each year without a visa. Every one of them will now need to prepare for much more comprehensive data submission during the screening process.

How This Changes Travel to the U.S.

More Time Needed for ESTA Applications

Travelers should expect longer completion times and potential follow-up requests for clarification.

Greater Scrutiny of Digital Presence

Public online activity can now influence a traveler’s risk assessment—potentially affecting ESTA approval or triggering additional questioning upon arrival.

Increased Privacy Concerns

The mandatory disclosure of social media handles, combined with expanded personal-data categories, has sparked debate about surveillance, free expression, and the proportionality of security measures.

Potential for Delays or Denials

Incomplete digital disclosures or inconsistencies between online and biographic information may lead to denial of travel authorization.

---

This change represents one of the most far-reaching updates to U.S. travel screening in over a decade, reflecting a broader shift in how governments assess risk in an age where our lives—public and private—exist online.