U.S. Customs and Border Protection is moving ahead with a sweeping modernization of its Electronic System for Travel Authorization (ESTA) and I-94 arrival/departure records, with changes that significantly increase reliance on mobile apps, biometrics and social media data. In a notice published in the Federal Register today, CBP details revisions to the information it collects under OMB Control Number 1651-0111, including new requirements that ESTA applicants submit a selfie and that the program transition from a web form to an app-only experience to improve fraud control and identity assurance.
The same package of changes folds CBP’s Voluntary Self-Reported Exit (VSRE) pilot more tightly into the travel data ecosystem. VSRE, launched earlier this year, lets foreign nationals subject to I-94 records confirm their departure via the CBP Home mobile app by submitting a combination of passport data, a facial image and device geolocation, creating a biometric audit trail that can help resolve alleged overstays or missing exit records. For CISOs and privacy officers, that means exit data is no longer strictly a by-product of carrier and port systems, but something individuals actively report through a mobile channel that collects sensitive device metadata.
The most controversial element is CBP’s proposal to make social media identifiers a mandatory field for ESTA, where they had previously been optional. According to public reporting, the agency intends to require applicants to disclose the social platforms and account handles they have used in roughly the past five years, citing a January 2025 executive order that directs DHS to lean more heavily on open-source information in counterterrorism vetting. Combined with the new selfie requirement and migration to a mobile-only channel, the net effect is to turn ESTA into a fully digital identity dossier that pairs biometric verification with long-tail behavioral data.
From an identity-security standpoint, the proposal raises familiar questions about proportionality, data retention and algorithmic risk. CBP is updating its Privacy Impact Assessments for the I-94, Arrival and Departure Information System (ADIS), and CBP Home, but those documents primarily govern internal protections rather than third-country access, cross-system linkages or secondary uses. CISOs at airlines, travel platforms and identity providers that integrate with U.S. travel systems will want to watch how these requirements crystallize, as they effectively expand the biometric and OSINT footprint that must be secured and governed across multiple jurisdictions.
Sources: Federal Register
—
By Ali Nassar-Smith
