The EU has found itself between a rock and a hard place: lose the visa-free regime with the US or give American authorities access to Europeans’ biometric data?
-
The EU has until December 31st, 2026, to agree to giving American authorities wide access to Europeans’ biometric and other personal data.
-
If the bloc refuses to do so, member states will lose the visa-free regime with Washington, allowing citizens to stay in the US for up to 90 days.
-
A watchdog warned that a draft EU-US agreement violates the bloc’s laws and poses a risk of American agencies targeting Europeans who oppose US policies.
Meanwhile, a watchdog is warning that the proposed changes would enable US authorities to target Europeans for their political views.
In 2022, Washington announced a new requirement for countries participating in the Visa Waiver Program (VWP), which allows their citizens to travel to the US for business or tourism for up to 90 days without a visa.
The requirement, which comes as part of a proposed bilateral Enhanced Border Security Partnership (EBSP), would give US authorities access to national biometric records for immigration screening and vetting.
This would result in American agencies accessing European police databases that include citizens’ biometric data, such as fingerprints and images, as well as criminal histories and even suspected but unproven crimes.
The EU countries must agree to do so by December 31st, 2026, or their citizens won't be able to travel to the US visa-free.
The European Commission said on April 22nd, 2026, that it was negotiating a framework that would grant US authorities access to sensitive citizens’ data under the EBSP.
The framework would apply to all EU countries, except Ireland, which is not in the Schengen zone, and Denmark, which has an opt-out.
It would be up to member states to decide which data and databases they wish to include in the information exchange, according to the Commission’s briefing.
The risk of political targeting
The requirement has unsettled Europeans, who are increasingly seeing the long-standing ally, the US, as a threat amid worsening relations under the Donald Trump administration.
Transatlantic friction sparked concerns about the transfer of European consumers’ data to the US, prompting a push for European digital sovereignty.
Watchdogs have warned about the risks posed by the data-sharing framework, noting that data protection and privacy are fundamental rights in the EU, governed by comprehensive legislation such as the General Data Protection Regulation (GDPR).
Have thoughts about this topic? Others do, too. Join them in the discussion.
State Watch, a London-based non-profit organization, published an analysis of a leaked draft agreement on May 1st, 2026, stating that it “manifestly violates EU law.” In addition, the watchdog warned that shared data could be used for a wide range of purposes.
“This includes preventing or arresting people traveling to the US who have voiced opposition to US policies in Europe, or for automated discriminatory profiling of travelers, including EU citizens,” the analysis reads.
For instance, Article 6 of the proposal would allow information exchange for the identification and screening of individuals suspected of posing a risk to public security or public order.
The organization says that such a vague standard would open the door for targeting Europeans and third-country nationals opposing Trump’s policies in Iran, Gaza, or elsewhere.
This includes preventing or arresting people traveling to the US who have voiced opposition to US policies in Europe, or for automated discriminatory profiling of travelers, including EU citizens.
State Watch
Several EU citizens have recently been denied entry to the US, including a French scientist, after immigration officials found messages criticizing Trump on his phone.
Moreover, the US issued travel bans in 2025 against five prominent European figures involved in efforts to regulate American tech companies in Europe.
The proposal stands in stark contrast to the current visa waiver agreement, which allows US authorities to search European police databases to determine whether travelers are involved in terrorism or serious crime.
The European Data Protection Supervisor (EDPS), an independent body that advises the Commission, issued an opinion in 2025 stating that it would be the first agreement allowing a third country to share large-scale biometric and other personal data for immigration control.
The EDPS urged authorities to ensure that processing personal data does not exceed the limits of what is “strictly necessary and proportionate,” and keep data “circumscribed exhaustively and as narrowly as possible.”
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked