The EU has put a border-data deal with Washington on the table to keep visa-free US travel

On 10 September the European Commission asked EU governments to sign a framework agreement with the United States on sharing traveller data, the arrangement Washington has made a condition of continued access to its Visa Waiver Program. Two proposals went to the Council of the European Union the same day: COM(2026) 484 to authorise signature, and COM(2026) 485 to conclude the agreement, the latter registered in the Council as document 13003/26, Brussels, 10 September 2026. The Commission says negotiations with Washington were completed on 23 July 2026. The timing matters as much as the content, because the United States expects these partnerships to be concluded by 31 December 2026, and the Commission is asking for the agreement to start applying before the EU has finished its own ratification steps.

Background

The requirement is not new and it is not aimed only at Europe. In 2022 the United States introduced a condition that every country admitted to, or aspiring to join, the Visa Waiver Program must conclude an Enhanced Border Security Partnership with the Department of Homeland Security. The programme lets citizens of participating countries travel to the US without a visa for up to 90 days for tourism or business. An EBSP is meant to give US authorities bilateral information exchange that lets them authenticate a traveller’s identity and determine whether they represent a threat. This builds on arrangements that already exist: the US has concluded bilateral agreements with EU member states on preventing and combating serious crime, which cover data, including biometric data, on people suspected or convicted of terrorism or serious crime. What the EBSP adds is exchange of information held in national databases about people travelling or intending to travel to the US, which is a far broader population. Because that data is held nationally but governed by EU law, member states could not simply sign individually. The Council gave the Commission a negotiating mandate on 16 December 2025.

What is actually being proposed

The framework agreement sets the conditions for reciprocal exchange of information between the competent authorities of member states and of the United States, for identity verification, screening and vetting in the context of border checks and applications for travel authorisations and visas, to determine whether someone’s entry or stay would pose a serious and genuine risk to public security or public order. The framework itself moves no data. It sets the rules, and each member state then concludes its own bilateral agreement with the United States underneath it. Several limits are built in. The automated part of the exchange is confined to the information necessary to identify a person; anything further is provided on request, with human oversight and the possibility of refusing. The agreement covers third-country nationals but also EU and US citizens, and sharing data on EU citizens is subject to strict reciprocity: if the United States categorically exempts its own nationals, member states are entitled to exempt all EU citizens. Member states may also halt the exchange if their status in the Visa Waiver Program changes.

The step that could come before Parliament votes

The sequence would normally be Council signature, European Parliament consent, then formal conclusion. The Commission is not waiting for all of it. It describes provisional application as a matter of urgency, given the US review of the Visa Waiver Program and the end-of-2026 deadline, and has proposed that the framework agreement apply provisionally as soon as possible and until both sides complete their internal procedures. In other words, the arrangement could begin operating before the European Parliament has given its consent. That is lawful for this kind of agreement, and it is also the part most likely to draw objection, because the Parliament’s leverage sits in a consent vote that would then be taking place over something already in effect.

Who it affects

Directly, this concerns EU citizens who travel to the United States without a visa: the holiday traveller, the person flying over for a week of meetings, the founder on an investor trip, the academic at a conference. All member states take part in the Visa Waiver Program except Bulgaria, Cyprus and Romania, whose nationals already need a visitor visa and whose position this file does not change. The programme allows stays of up to 90 days for tourism or business only, so it was never a route for anyone moving to the United States to live or work. That has always required a visa and is untouched here. The exposure is at the other end: a member state without a partnership in place would see its nationals fall back on applying for a B-1/B-2 visitor visa, with an appointment, a fee and an interview, for trips they currently make on an approved ESTA. For anyone who crosses the Atlantic more than occasionally, that is a real difference in cost and lead time.

The privacy objection is not a footnote

This would be among the first EU agreements with a non-EU country involving large-scale sharing of personal and biometric data for border and immigration control, and the supervisory authorities have said so in terms. The European Data Protection Supervisor, in a September 2025 opinion on the negotiating mandate, argued that the interference with the rights to privacy and data protection is comparable in seriousness to data exchanges for law enforcement purposes, supported a common EU framework rather than 27 separate national deals, and called for the scope to be defined narrowly and processing limited to what is necessary and proportionate. In March 2026 the Chair of the European Data Protection Board, Anu Talus, wrote to the Commission warning that the partnerships could significantly affect fundamental rights, in particular the protection of personal data. Those objections are about scope and safeguards rather than about whether any agreement should exist, and they are the substance the Parliament will be voting on.

What this means in practice

Nothing changes for a trip you are taking this autumn. ESTA rules, the 90-day limit and the tourism-or-business restriction are unchanged while this works through the Council and the Parliament, and no member state has been removed from the programme. There is no action to take, only a date to watch: the fourth quarter of 2026, when the Council step and any provisional application would need to happen for bilateral agreements to be concluded by 31 December. If you hold dual nationality, it is worth knowing which passport you would fall back on. And if you are planning a US move rather than a US trip, none of this touches your route. Our <a href="/country-guides/united-states">United States country guide</a> covers the visa categories that do, and the <a href="/field-guide/visas-status">visas and status</a> section of the field guide explains where a travel authorisation like ESTA stops and a visa begins.