Recently, under the Trump administration, a U.S. Customs and Border Protection (CBP) proposal would vastly extend existing visa requirement checks. These would include up to five years of social media history; all email addresses used in the past decade; and a widening of biometric data collection beyond current practice – which is limited to facial images and fingerprints – to include iris scans and, most worrying to many, the collection of DNA samples. Applicants would also be required to provide the names, birthdates, birthplaces, and addresses of family members, including children.
The proposal would see travellers from 42 countries on the visa waiver plan, including Australia, Britain, France, Germany, Japan and South Korea, affected.
Why the changes?
The CBP said the changes to the Electronic System for Travel Authorisation (ESTA) application system were required to comply with Donald Trump’s executive order issued on his first day of the new term. In this order, Donald Trump said the changes were to ensure that US visitors “do not bear hostile attitudes toward its citizens, culture, government, institutions, or founding principles.” The CBP says the step is intended to “keep the American people safe.”
What do opponents and many independent observers say?
Civil liberty groups, privacy advocates, travel and tourism organisations and some politicians reacted with alarm. Objections included privacy invasion, data security risks, operational infeasibility, diplomatic/tourism fallout and a chilling violation of free expression.
Effect on tourism
Other critics stress practical harms: the U.S. Travel Association warned that onerous requirements will push visitors to other destinations, potentially harming tourism and raising concerns ahead of events such as the 2026 World Cup.
Many of my friends posted on various social media platforms that Trump’s America had become a no-go zone for them, and this is reflected in Washington State Senator Patty Murray’s post on Bluesky, “It would be easier to just ban tourism.” The new rules are also a worry for many fans wishing to visit the US to watch their team play in the World Cup this summer. Do you really want to submit your family members’ details and DNA to Trump just to watch a game of football? And what precedent does this set? Will every country now use events like the World Cup and Olympics to harvest DNA data? Where does this end? What will China decide to collect next time they host such an event?
Indeed, Bethany Allen, the Head of China Investigations and Analysis at the Australian Strategic Policy Institute, wrote on Bluesky, “Wow — even China doesn’t do this”.
Privacy invasion
Critics of the proposed travel vetting expansion have blasted the policy as a stark invasion of privacy. Sarah McLaughlin, senior scholar for global expression at the Foundation for Individual Rights and Expression (FIRE) said:
“Those who hope to experience the wonders of the United States ― from Yellowstone to Disneyland to Independence Hall ― should not have to fear that self-censorship is a condition of entry.” Further stating, “Requiring temporary visitors… to surrender five years of their social media to the US will send the message that the American commitment to free speech is pretence, not practice.”
Data security risks and operational infeasibility
Privacy International warned that collecting social media, email and DNA together would be unprecedented and observed that “analysing this data will likely require AI tools to summarise our lives” and that “companies and governments must push back now, lest they enable and copy these practices.”
They go on to explain that it is likely AI will be used to scan and summarise your social media behaviours to determine what kind of person you and your family members are, who you associate yourself with, and who you like and follow. This raises a fundamental question: will a human ultimately be making these decisions? Privacy International believes it is far more likely that decisions will be automated, with potentially significant consequences for people’s lives and livelihoods.
There is also the issue of data scope vs accuracy. Five years of social media and 10 years of email records will generate vast datasets. How would AI be tasked with analysing this material, and could it reliably distinguish harmless satire from genuinely malicious content? Critics warn that such systems are inherently error-prone, raising the risk of false positives and unfair visa denials.
There are also significant concerns about the security risks posed by the centralised storage of information with such sensitive identifiers, especially DNA and extensive lists of email addresses, in the event of a data breach. More broadly, critics argue that the government’s ability to securely store data at this scale is yet to be proven.
Free speech
Compelling visitors to hand over traces of their political, religious or activist viewpoints raises serious misgivings regarding the First Amendment as well as potential wider human rights violations. Many groups have raised concerns, the Electronic Frontier Foundation wrote, “the Disclosure Requirement’s potential to expose vast amounts of applicants’ personal information, the policy chills First Amendment-protected speech of both the applicants themselves and their social media connections.”
Trump is already attacking free speech, with the US State Department recently revoking the visas of six people from Argentina, Brazil, Germany, Mexico, Paraguay, and South Africa for denouncing Charlie Kirk’s politics as being far right and racist. South African music executive Nhlamulo Baloyi, commenting on Americans mourning his death, said he was “hurt because the racist ended in martyrdom,” and mocked how “he was being used to bolster a movement of white nationalist trailer trash.”
An Argentinian wrote that Kirk “devoted his entire life to spreading racist, xenophobic, misogynistic rhetoric. It’s hot as f*ck where this man currently is, and it’s deserved.” Meanwhile, a Paraguayan posted, “Charlie Kirk was a son of a b**** and he died by his own rules.”
So there we have it, none of the posts threatened violence or promoted harm. They were just anti Charlie Kirk. It appears like Trump and his associates are only closing down dissenting voices that don’t like the same people he does or don’t agree with him.
Where this stands and what happens next?
The notice published by CBP has already begun a 60-day comment period; it is not an immediate change in law. That means stakeholders such as advocacy groups, businesses, foreign governments, and individuals can submit formal comments on the benefits or indeed harms before the agency decides whether or not to proceed, modify, or abandon the rule. If finalised, implementation would follow the regulatory timetable set by the agency.
So where do we go from here?
These measures seem to have few bounds, and I fear other countries are likely to follow suit. Most Americans, like us British, are indeed boat people; indeed, so many of us will have all sorts of DNA showing up in our profiles. Will Iranian DNA from 150 years ago now become a reason for visa denial? I think many proud Brits and Americans would be shocked by their own DNA analysis. I remember in my late teens thinking people convicted of racist acts should have their own DNA results presented to them to show many of them where they really are from.
But what is more worrying is where this is all leading, not only in the US but also in other countries. What would Hitler have done with this data?
Where will it end?
Friends of Bylines Network
There has never been a greater need for grassroots journalism that investigates the stories that really matter, holds power to account and champions the voices of everyday citizens. We are proudly powered by volunteers but what we do isn’t free.
STAND WITH US for independent, citizen-led journalism that makes democracy stronger, and you will even get some exclusive benefits.
