Since this weekend, numerous media outlets have claimed that new requirements would come into force “this Monday” for travel to the United States under the ESTA application process, the Electronic System for Travel Authorization used by travelers from 42 visa-waiver countries, including European states.
At issue are data elements described as now mandatory to obtain an ESTA, ranging from the disclosure of social media usernames or multi-year social media histories to more detailed family information.
Repeated from one website to another, sometimes under alarmist headlines, these reports have quickly sparked confusion and concern among travelers. Some have come to believe that refusing to provide such data could now automatically result in a denial of travel authorization.
Yet while the changes cited do stem from an official document published last December by the U.S. administration, portraying them as immediately applicable is based on a misreading of that text.
What the official document actually says: a consultation, not a decision
The document in question, published in the Federal Register on December 10, 2025, is neither an executive order nor a “final rule” that would take effect overnight.
It is a 60-Day Notice and Request for Comments, a consultation notice issued under the Paperwork Reduction Act, the U.S. process that governs how federal agencies collect information from the public.
In practical terms, the agency involved, U.S. Customs and Border Protection (CBP), is outlining what information it is considering requesting, explaining the rationale for the collection, and inviting public feedback (from individuals, businesses, associations, legal experts, and others) before making any decision.
The February 9, 2026 date marks the close of the public comment period, not an implementation date.
What would still need to happen before any possible implementation
After a 60-day notice, there is no automatic switch-over the next day.
The process that follows typically looks like this:
1) Review of comments and potential revisions
CBP may revise, scale back, clarify, or even drop certain proposed data fields based on the feedback received, considering factors such as administrative burden, technical feasibility, privacy concerns, and demonstrated security value.
2) Submission to OMB and issuance of a new 30-day notice
If the agency chooses to move forward, it must submit the information collection to the Office of Management and Budget (OMB) for review. A 30-day notice is usually published at that stage, indicating that the proposal is now under OMB consideration. Any additional comments are then directed to OMB.
3) OMB decision: approval, revision request… or rejection
OMB may approve the proposal, send it back for changes, or reject it outright. Without OMB approval, or a valid OMB control number covering the collection, the government cannot legally require the public to provide the new information.
4) Operational rollout (if approved)
Only after all these steps could CBP actually implement the changes (updates to forms, online portals, apps, and procedures). And if some of the proposed changes go beyond mere “information collection” and create substantive new obligations, an additional rulemaking process (proposed rule followed by a final rule) may be required, further extending the timeline.
Why WTTC and GBTA are sounding the alarm
It is precisely this still-hypothetical prospect that has prompted reactions from the travel industry.
The World Travel & Tourism Council (WTTC), which represents major global tourism stakeholders, and the Global Business Travel Association (GBTA), the leading international organization for business travel, have both raised concerns about the potential impact of these proposals on the attractiveness of the United States and the ease of international travel.
WTTC has recently warned that measures perceived as overly intrusive could contribute to an image of the U.S. as a “less welcoming” destination, potentially reducing visitor numbers and tourism spending, with knock-on effects for jobs.
GBTA, for its part, submitted formal comments calling for a “balanced” approach: limiting data collection to what is strictly justified, ensuring compliance with international data protection standards, and avoiding measures that could discourage business travel to the United States.
At this stage, providing social media information as part of an ESTA application remains optional, and none of the changes discussed in recent days have entered into legal force. They remain proposals under review, subject to modification, amendment, or the possibility of never being implemented at all.
