U.S. Immigration Alerts

Customs and Border Protection Proposes Changes to ESTA and I-94 Procedures

U.S. Customs and Border Protection (CBP) is advancing a sweeping update to how travelers apply for travel authorization under the Visa Waiver Program (VWP) and how their arrivals and departures are recorded. The revisions, outlined in a notice published in the Federal Register on December 10, 2025, would expand the personal and biometric data collected via Electronic System for Travel Authorization (ESTA), require tougher identity verification, and shift applications to mobile only. The agency also proposes a voluntary, biometrically confirmed exit-reporting tool for foreign travelers who depart the United States under Form I-94 requirements. Public comments are being solicited for 60 days through early February 2026.

Key Points

• Mandatory Social Media Disclosure: As part of meeting the requirements of Executive Order 14161, CBP will add social media identifiers used in the prior five years as a required field for all ESTA applicants. This moves social media disclosure from a discretionary item to a mandatory one. 
• Expanded High-Value Data Collection: The updated ESTA application would request far more detailed personal, contact, family, and biometrics data. This includes phone numbers used over the past five years, email addresses from the past ten years, IP addresses and photo metadata, names and birth details of family members, family contact info and residences, plus biometrics (face, fingerprint, DNA, iris), and even business contact details. 
• Required Selfie Photo Uploads: Both the ESTA website and mobile app will be updated to demand a separate facial photograph (“selfie”) in addition to the passport biographical page photo. Third-party submissions will no longer bypass the requirement. 
• ESTA Website to Be Decommissioned — Mobile Only: CBP plans to retire the current ESTA application website, making the mobile app the sole method for new ESTA submissions. The website may remain for status checks and information only. 
• Optional Mobile Exit-Reporting for I-94 Travelers: Under a new “Voluntary Self-Reported Exit” (VSRE) pilot, foreign nationals subject to I-94 requirements can use the CBP Home app (or successor) to submit passport data, a live selfie, and geolocation to confirm their departure from the United States. CBP will use “liveness detection” and facial comparison to existing records, and record the exit in the Arrival and Departure Information System (ADIS). 
• Significant Increase in Data-Collection Burden: According to CBP’s estimate, the changes will apply to tens of millions of responses annually, including over 14 million ESTA submissions — underscoring the scale of the program and the impact of these revisions. 

What US Employers Need to Know

• More Stringent Screening for Business Travelers: Employees traveling to the U.S. under the VWP for business will face more extensive scrutiny. The expanded data collection — including social media, biometrics, and family information — increases the likelihood of deeper background checks and potential delays.
• Potential Delays in ESTA Approvals: With more complex application requirements and additional verification steps, companies should anticipate longer processing times before ESTA approval. Short-notice business trips may be harder to plan.
• New Compliance Burdens for Travel Departments: Organizations that handle ESTA filings on behalf of employees will need to shift to the mobile app platform once the website is retired. Internal procedures may need updating, and staff or travelers may require guidance on new data and biometrics requirements.
• Increased Risk of Denials or Additional Scrutiny: With access to far more information — including social media — CBP may identify red flags more frequently. Employers should be ready for possible denials or heightened scrutiny for employees with complex digital or family histories.
• For Frequent Travelers: Exit Reporting May Offer Value—and Complexity: The optional exit-reporting tool may help travelers document compliance with departure requirements, particularly useful for certain visa statuses. However, using it involves biometric and geolocation submissions — a consideration for travelers’ privacy and for employers managing frequent travel.

SOURCE: Federal Register, December 10, 2025: www.federalregister.gov/documents/2025/12/10/2025-22461/agency-information-collection-activities-revision-arrival-and-departure-record-form-i-94-and