U.S. Customs and Border Protection (CBP) published a notice today in the Federal Register opening a 60-day public comment period on a series of proposed changes to the Electronic System for Travel Authorization (ESTA), used by travelers under the Visa Waiver Program (VWP). These proposals, still in draft form, aim to strengthen identity verification, modernize traveler-facing tools, and meet new regulatory requirements.
The CBP notice is part of the Paperwork Reduction Act, which requires federal agencies to submit new data-collection initiatives for public review before approval.
CBP is inviting citizens, experts, and agencies to comment on the necessity, relevance, and impact of these potential changes, which could ultimately reshape how travelers obtain authorization to enter the United States.
Is ESTA about to move away from web-based applications?
One of the most significant proposals would end the submission of ESTA applications through the website, shifting exclusively to the “ESTA Mobile” app.
The website would remain available to provide information and allow users to check the status of an authorization, but it would no longer accept applications.
Several factors are driving this change:
- A large number of poor-quality passport photos uploaded on the website, preventing reliable facial comparison;
- The website’s inability, unlike the mobile app, to read passport chips using NFC;
- Increasing exploitation of technical vulnerabilities by fraudsters uploading forged documents;
- A rise in fraudulent third-party websites charging travelers without actually submitting applications to CBP.
The mobile app, already used by millions of travelers, incorporates enhanced identity-verification features: mandatory live selfie checks, facial recognition, and electronic passport-chip reading.
Social media at the heart of traveler screening
As part of the implementation of Executive Order 14161, signed in January 2025 to bolster protections against foreign threats, CBP is proposing to make the disclosure of social media handles used in the past five years mandatory for all ESTA applicants.
Previously optional, this information would become a key component of the security vetting process carried out by the Department of Homeland Security (DHS).
CBP states that this measure is intended to harmonize practices across federal agencies and adapt the vetting process to modern communication methods and digital identity patterns.
The stated objective is to improve the government’s ability to identify inconsistencies, identity fraud, or possible links to individuals or organizations deemed national-security risks.
Mandatory photo for all ESTA applications
CBP is also proposing to make the capture or upload of a selfie mandatory for all ESTA applications, whether submitted through the website or by a third party.
In practice, the official portal (esta.cbp.dhs.gov) already asks most travelers to upload a face photo in addition to their passport image. However, this requirement is not applied uniformly and does not involve live image capture, unlike the mobile app.
The proposed change would extend to the website the requirement already in place on the ESTA Mobile app, which mandates an instant photo automatically compared with the passport image through CBP’s biometric-verification system.
This harmonization may seem surprising, since CBP is considering ultimately reserving application submission exclusively for the mobile app, meaning the website update may simply serve as a temporary stopgap before a full transition to mobile-only processing.
A significant expansion of collected data: The “High-Value Data Elements”
To comply with federal directives issued in 2025, CBP is proposing to add a series of high-value security fields to ESTA, in addition to the information already collected.
These would include:
- Phone numbers used within the past five years;
- Email addresses used within the past ten years;
- IP addresses and metadata associated with submitted photos;
- Names, birth details, addresses, and contact information for immediate family members;
- Additional biometric data, including facial, fingerprint, and iris data, and, when applicable, DNA;
- Professional phone numbers and email addresses from the past five to ten years.
These additions are intended to standardize federal forms and strengthen tools used to detect fraud or identity theft.
Voluntary Self-Reported Exit: A pilot program running parallel to ESTA changes
Alongside its proposed updates to ESTA, CBP notes that it is already testing the Voluntary Self-Reported Exit (VSRE), a feature allowing travelers subject to the I-94 requirement to voluntarily report their departure from the United States through the CBP Home app.
Travelers can submit their biographic information, a mandatory selfie, and their geolocation, data that allows CBP to biometrically confirm that they have left the country.
This feature, considered useful for reducing uncertainty around departures (especially at land borders), could help travelers demonstrate compliance with their authorized stay when seeking entry in the future.
