EDPB letter to the European Commission on the privacy implications of recent proposed legislative changes regarding entry conditions to the United States for EEA citizens

March 2026 Subject: Privacy implications of recent proposed legislative changes regarding entry conditions to the United States for EEA citizens Dear Commissioner M c G rath , Dear Commissioner B runner, The EDPB has become aware of the recent proposed legislative change s regarding entry conditions to the United States for E EA citizens. The United States Customs and Border Protection (CBP) proposes a revision 1 of the Electronic System for Travel Authorisation (ESTA) process in the US, which is the mechanism that allows citizens of certain countries (including most EEA member states 2 ) to en ter the United States for a short stay (less than 90 days) without a visa. The Notice was proposed on 12 October 2025 and submitted for public consultation until 9 February 2026 3 . The proposal would allow for the collection , and/ or require the disclosure , of a significant volume of EEA individuals’ personal data , i ncluding information about their social media activity in the last five years , as well as personal data of their family members, which are not related to the ESTA applicant’s travel. T he CBP also intends to require applicants to submit ESTA applications solely via the ESTA Mobile application, provided by the CBP, and no longer via the existing ESTA website . It is also unclear how data subjects would be able to exercise their rights with regard to their personal data, which could include biometric data.

The United States Customs and Border Protection (CBP) published a Notice seeking public comments on revisions to Form I - 94 arrival/departure records and the Electronic System for Travel Authorization (ESTA) program.

Austria, Belgium, Croatia, Czechia, Denmark, Estonia, Finland, Fra nce, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden.

At the time of writing this letter and given the announced legislat ive schedule, the proposed changes are subject to change. In this context, the EDPB would be grateful if you could indicate whether the European Commission has taken , or plans to take, any action in this regard , as t his proposal raise s significan t concerns for the protection of the fundamental right of data protection of EEA individuals . It would be particularly useful for the Commission to ask US authorities on the possibility for EU data subjects to effectively exercise their rights under the US Privacy Act and on the duration of retention of that data . In addition, the EDPB has also become aware of the Commission’s ongoing negotiations regarding the framework agreement for “E nhanced B order S ecurity P artnerships ” . The framework agreement as well a s the individual agreements between the Member States and the USA could significantly impact the protection of fundamental rights, in particular the right to protection of personal data. We invite the Commission to provid e further information on this matter. The EDPB would be willing to cooperate with your services on this matter , in case you would find it appropriate . The EDPB remains at your disposal for any further exchanges on this matter. Yours sincerely , Anu Tal us