Border control at United States airports: what happens to travellers and their data

Arriving: the steps at the border

Travellers landing in the United States are inspected by CBP. CBP says it uses facial comparison at entry at all international airports under the name Simplified Arrival ¹. The traveller stands in front of a camera. The live image is matched against photos from passports and other travel documents through a cloud service called the Traveler Verification Service (TVS) ¹.

Before the plane lands, the airline has already sent a passenger manifest to CBP through the Advance Passenger Information System (APIS) ⁷. Officers can see who is on board before the doors open.

US citizens and Canadian visitors can use Mobile Passport Control. They enter passport details and answer CBP questions in an authorised app after landing. The app produces a receipt with an encrypted QR code. The traveller still sees an officer with a physical passport. A CBP page last modified on 2 December 2020 listed 27 airports and 4 seaports offering it ⁶.

Entry permission: visa, ESTA and fees

The Visa Waiver Program lets citizens of participating countries visit for business or tourism for up to 90 days without a visa. A CBP page last modified on 7 October 2024 lists 41 countries. The Electronic System for Travel Authorization (ESTA) is the automated system that decides whether a visitor can travel under the program ⁴. Travellers from other countries need a visa ⁴.

ESTA fees rise each year with inflation under a law known as HR-1. A Federal Register notice dated 1 October 2026 sets the fiscal year 2027 fee at $40.62 per approved authorisation. A denied application costs $10.62. CBP began charging these amounts on 16 October 2026 ⁵.

Chinese nationals holding a 10-year B-1, B-2 or B-1/B-2 visa must enrol in the Electronic Visa Update System (EVUS) before travel. The fiscal year 2027 EVUS fee is $31.75 ⁵.

Biometrics and automated processing

A DHS final rule published on 27 October 2025 took effect on 26 December 2025. It lets DHS require all non-citizens to be photographed when entering or leaving the United States. It removed earlier exemptions for children under 14 and adults over 79. It allows photo collection at airports, land ports and seaports on departure as well as arrival ².

US citizens may take part in facial comparison but keep the right to opt out ². CBP says a citizen who opts out can ask for alternative processing, which usually means an officer checks the documents by hand ³.

Since 2004, CBP has taken fingerprints and a photo on entry from in-scope foreign travellers. It sends these to IDENT, the biometric system run by the DHS Office of Biometric Identity Management (OBIM). A successor system called HART is in development ².

CBP reports facial comparison at exit at 55 airport locations. It says the technology has processed more than 540 million travellers and stopped more than 2,000 impostors ¹. These figures come from CBP and are not independently audited on that page.

Passenger data: APIS and PNR

US regulations at 19 CFR 122.49a require every commercial aircraft arriving in the United States to send a passenger manifest to APIS. Batch transmissions must arrive no later than 30 minutes before the aircraft doors are secured. Interactive transmissions for each passenger must arrive no later than the securing of the aircraft ⁷.

The manifest covers full name, date of birth, gender, citizenship, country of residence, travel document details, a US address for most visitors, the booking reference if available, and flight details ⁷.

Passenger name records (PNR) come from airline booking systems. For flights from the EU, a 2012 agreement between the EU and the United States governs the transfer to DHS. Airlines first send PNR 96 hours before scheduled departure and then send updates ⁸. See our page on API and PNR for how these two data sets differ.

Watch lists and checks

The Transportation Security Administration (TSA) runs Secure Flight. Under it, TSA checks passengers against government watch lists before boarding passes are issued, for flights within or bound for the United States. Passengers give their full name as it appears on their ID, date of birth, gender and a redress number if they have one. Airlines did this matching before Secure Flight ⁹.

Travellers who are delayed or denied boarding, held at a port of entry, or sent to secondary screening again and again can apply to the DHS Traveler Redress Inquiry Program (DHS TRIP). The program issues a Redress Control Number. Travellers can then give that number when booking flights ¹⁰. Our watch lists page covers how listing and redress work in other countries.

Your data: retention and how to ask for records

The October 2025 rule sets out how long CBP keeps traveller data ². The figures below come from that rule. DHS publishes its privacy notices for these systems on its website ².

Under the EU and US agreement, DHS keeps PNR in an active database for up to five years. After the first six months the data is depersonalised and masked. It then moves to a dormant database for up to ten years. Any person, whatever their nationality, may ask DHS for their PNR and seek correction ⁸.

People can ask CBP for records under the Freedom of Information Act through the SecureRelease portal. CBP describes FOIA as giving any person access to agency information, subject to exemptions ¹¹. Watch list and screening complaints go to DHS TRIP ¹⁰.

Who runs the systems

CBP, part of the Department of Homeland Security (DHS), runs border inspection, APIS, TVS and the entry and exit programme ^1,27. OBIM runs IDENT ². TSA runs Secure Flight and airport checkpoints ^9,12.

The TVS matching service runs in the cloud. The DHS rule says CBP's cloud service provider deletes gallery data automatically and does not hold the encryption keys. The rule does not name the provider ². Our vendors page covers published contract awards.

Security screening on departure

TSA allows liquids, gels and aerosols in carry-on bags in travel-sized containers of 3.4 ounces (100 millilitres) or less, packed in one quart-sized bag. Larger containers go in checked baggage. Duty-free liquids over that size can be carried when connecting to a US flight if they were sealed by the retailer in a tamper-evident bag with a receipt from the past 48 hours ¹².

Since 7 May 2025, travellers aged 18 and over on domestic flights need REAL ID compliant identification or another accepted document such as a valid passport ¹³.

Airlines collect the September 11 Security Fee on behalf of TSA. It is $5.60 per one-way trip, with round trips capped at $11.20 ¹⁴. Departing foreign travellers may be photographed on departure under the biometric exit programme ^1,2.