The Government’s Growing Trove of Social Media Data

Reviewing individuals’ social media to conduct ideological vetting has been a defining initiative of President Trump’s second term. As part of that effort, the administration has proposed expanding the mandatory collection of social media identifiers. The proposal would widen the government’s social media surveillance dragnet to include not only travelers, visa applicants, and visa holders, but also their U.S. citizen contacts. By linking individuals’ online presence to government databases, officials could more easily identify, monitor, and penalize people based on their online self-expression, raising the risk of self-censorship driven by fear of misinterpretation or adverse consequences.

Most recently, the State Department issued a cable directing consular officers to review the social media of all student visa applicants for “any indications of hostility towards the citizens, culture, government, institutions or founding principles of the United States,” as well as for any “history of political activism.” This builds on earlier efforts this term, including the State Department’s “Catch and Revoke” program, which promised to leverage artificial intelligence to screen visa holders’ social media for ostensible “pro-Hamas” activity, and U.S. Citizenship and Immigration Services’ April announcement that it would begin looking for “antisemitic activity” in the social media of scores of foreign nationals in the United States. As the Brennan Center has explained, both of these programs pose substantial threats to civil liberties and due process.

But the collection and use of social media for screening and vetting is hardly new. The Brennan Center and other civil society organizations have long sounded the alarm about the harms of the large-scale use of social media for high-stakes determinations related to immigration. This article provides an overview of this collection process and how the data is used.

The U.S. government collects and uses social media data at nearly every stage of the immigration process, from the moment someone abroad applies for a visa to long after they’ve entered the country. This system, largely built by the Department of Homeland Security (DHS) and the State Department, pulls social media content into government databases through visa applications, electronic device searches, AI-powered monitoring tools, and continuous screening programs.

Outside the United States: Visa Applicants, Refugees, and Visa Waiver Program Travelers

The social media data collection process begins overseas. Nearly a decade ago, DHS began requesting social media identifiers from travelers coming from any country covered by the Visa Waiver Program, which allows citizens of 42 countries — primarily in Western Europe —to travel to the United States for up to 90 days without a visa. Travelers must obtain approval through the Electronic System for Travel Authorization, an automated system that determines eligibility to travel. Since 2016, the travel authorization application form has included an optional category for social media identifiers.

In 2019, near the end of Trump’s first term, the identifier collection expanded significantly, as the State Department began requiring individuals applying for immigrant visas, including immigrant employment visas and family visas, to provide the social media identifiers they had used in the previous five years. The same year, the State Department also began collecting five years’ worth of social media identifiers from people applying for nonimmigrant visas, affecting about 14 million applicants annually. These include student and exchange visitor visa holders, those seeking medical treatment, nannies, diplomats, physicians, intracompany transferees, people with specialized skills, and business visitors. The Brennan Center and the Knight First Amendment Institute brought a legal challenge against the State Department’s collection and DHS’s retention of this data on the grounds that it violated the First Amendment by forcibly unmasking anonymous and pseudonymous speakers.

In 2023, DHS expanded the Electronic Visa Update System to request (but not require) social media identifiers on those forms. The visa update system is used by Chinese nationals holding a 10-year visa who must periodically update basic biographic information to maintain eligibility for admission to the United States.

Finally, DHS recently issued a notice proposing to collect social media identifiers from people applying for immigration benefits, a term of art covering naturalization and authorization to live and work in the United States. A small number of the covered applicants, fewer than 200,000 out of 3.6 million annual applicants, apply from outside the United States, primarily people seeking advance permission to enter as otherwise inadmissible nonimmigrants or applying for refugee classification. While the refugee program is currently suspended, if it is reinstated, U.S. Citizenship and Immigration Services is expected to resume its use of social media identifiers to conduct “enhanced review” of some refugee applicants.

At the U.S. Border: All Travelers, Regardless of Citizenship Status

At the border, any traveler, regardless of citizenship status, may face additional scrutiny. Under a 2018 Customs and Border Protection policy, U.S. border agents are authorized to inspect electronic devices carried by any traveler, regardless of citizenship, without a warrant or probable cause. Agents may examine phones, computers, and other devices to review posts and private messages on social media, even if they do not suspect any involvement in criminal activity or have immigration-related concerns. While officers are instructed to take measures to limit their access to data — including putting devices into airplane mode, limiting searches to locally stored content, and refraining from accessing data stored on the cloud — two recent reports from the DHS inspector general found that border protection officers fail to consistently disable network connections.

Even when these restrictions are followed, a significant amount of social media content can be viewed: X (formerly Twitter), for instance, stores videos, images, and profile data locally, and any posts or direct messages that were refreshed before the device was taken offline can be viewed. Similarly, content and direct messages on Facebook and Instagram are visible when the apps are opened, as are likes, comments, and shares made while the user was not connected to the internet, since those are stored locally while the app is offline.

In addition, Customs and Border Protection’s policy permits agents at the border to conduct advanced forensic searches if they receive supervisory approval and have reasonable suspicion of a legal violation or a “national security concern.” These searches involve the use of software or hardware tools to copy, analyze, or extract data from a device, which could include social media data stored in the cloud. While U.S. citizens cannot be prohibited from entering the country if they refuse a search, their devices may be detained. Noncitizens can be barred outright.

The constitutionality of these searches has been challenged, and as a result, different legal rules apply in some parts of the country. Stricter rules govern the western states, while the Eleventh Circuit, which covers Alabama, Florida, and Georgia, has held that no suspicion is needed even for forensic searches of electronic devices. As a result, travelers flying into Atlanta’s Hartsfield-Jackson Airport, the busiest airport in the world, may have their devices searched — and a range of social media data accessed and recorded — for any reason or no reason at all.

Inside the United States: Visa Holders, Legal Permanent Residents, and Citizens

As noted above, U.S. Citizenship and Immigration Services has issued a proposal that, if approved, will allow it to immediately begin collecting social media identifiers from individuals submitting a range of immigration-related applications. These include applications for naturalization and green cards, adjustment of status, asylum or withholding of removal, and requests to reunite with family. The vast majority of those covered by the collection — nearly 3.4 million of the estimated 3.6 million annual applicants — are already within the United States.

The rule would require many applicants to provide the social media identifiers of their relatives, including their U.S. citizen parents, children, and spouses or former spouses, whose information would be retained in DHS databases as well. The first Trump administration published a similar proposal, which was rejected by the Biden White House’s Office of Management and Budget for reasons including the department’s failure to “adequately demonstrate[]” the “practical utility” of collecting the information.

Once social media identifiers and content have been collected, the data can be retained, used, and shared by a range of government agencies in support of the new initiatives outlined above or for other reasons. (For an in-depth treatment of DHS’s use of social media, see this 2019 Brennan Center report.) For instance, DHS’s Automated Targeting System, a powerful data collection and analytics tool, scours the social media identifiers collected by the State Department to flag any potential “derogatory” information that may be relevant as the department decides whether to grant or deny a visa. DHS also manages Continuous Immigration Vetting, which monitors individuals long after they have arrived, automatically flagging any new information that might raise national security or public safety concerns, including social media posts. Continuous Immigration Vetting is triggered when an individual submits an immigration-related application, such as for adjustment of status, or when new derogatory information is discovered in government databases. In these cases, Customs and Border Protection’s Automated Targeting System checks for matches and sends results to ATLAS, a system that uses automated rules to assess national security risks, resulting in consequences that include deportation and denaturalization, based in part on factors like social media data.

These processes are also facilitated by the files that DHS keeps on every non–U.S. citizen throughout the immigration, vetting, and screening process. Alien Files, or A-Files, hold “social media handles, aliases, associated identifiable information, and search results,” along with all the other data collected through the process. A-Files are retained for 100 years, long after an individual receives a green card or becomes a naturalized citizen.

Customs and Border Protection plays an important role as well, managing the National Targeting Center, which facilitates the continuous vetting of every traveler planning to enter the United States, including U.S. citizens and holders of immigrant and nonimmigrant visas. The targeting center uses sources such as social media to conduct routine analyses and determine whether individuals pose a risk or are otherwise inadmissible. Customs and Border Protection also oversees the National Vetting Center, established during the first Trump administration, which consolidates data streams to help agencies identify “known or suspected threat actors.” While the vetting center does not incorporate social media into its own vetting processes, the agencies it supports — including Customs and Border Protection, U.S. Citizenship and Immigration Services, and the State Department — do. Current limitations on the vetting center’s use of social media can be rescinded at any time and can clear the way for social media to become a fully integrated tool in the government’s centralized vetting infrastructure. Notably, the tools used by DHS’s antisemitism task force are run by the National Targeting Center and National Vetting Center.

Finally, Homeland Security Investigations, an arm of U.S. Immigration and Customs Enforcement, can scour social media platforms and interact with individuals using online aliases to carry out criminal investigations. It can also use social media to assist in locating, arresting, and adjudicating the cases of individuals suspected of immigration violations. Data gathered from social media investigations is used to build dossiers on targets, track their location and associations, and confirm identities through photos. Through the Overstay Lifecycle Program, ICE also monitors nonimmigrant visa holders’ social media for derogatory information. The tools at ICE’s disposal include RAVEn, a controversial AI-powered analytical platform that processes social media information and other personal data to generate leads and support enforcement actions.

Finally, numerous interconnected systems share social media information. Social media identifiers collected from nonimmigrant and immigrant visas are retained in the Consular Consolidated Database, the State Department’s repository for all visa records. This data is analyzed by DHS personnel and shared with other federal agencies. DHS’s A-Files draw on information from the Central Index System, a DHS-wide index maintained by Citizenship and Immigration Services that aggregates data from across DHS components and the State Department. Within Citizenship and Immigration Services, data flows freely among systems like the Automatic Targeting System to vet and monitor noncitizens and support immigration enforcement, including by scraping and analyzing publicly available social media information. In addition, Customs and Border Protection’s TECS database documents social media data obtained through electronic border searches, among other information, and facilitates interagency data sharing. Homeland Security Investigations, ICE’s investigative arm, can query TECS to retrieve social media data and other information on individuals linked to their investigations.

A March 2025 executive order directed at breaking down information-sharing protections is likely to further facilitate expansive data sharing and consolidation between and within agencies, effectively lowering barriers to access and increasing the likelihood that social media information collected for a limited purpose will instead be recycled through the system.