DHS/CBP/PIA-0076a Collection of Advance Information from Certain Undocumented Individuals on the Land Border

Privacy Impact Assessment Update
for the

Collection of Advance Information from Certain
Undocumented Individuals on the Land Border:
Post Title 42
DHS Reference No. DHS/CBP/PIA-076(a)
May 12, 2023

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 1

Abstract
The CBP One™ mobile application allows certain undocumented individuals1 to submit
biographic and biometric information to U.S. Customs and Border Protection (CBP) in advance of
their arrival in the United States, and to schedule a time to present themselves at a port of entry
(POE) for processing. CBP is conducting this Privacy Impact Assessment (PIA) update to provide
transparency regarding changes to the process as a result of the termination of Title 42, including
a change in the way in which undocumented individuals schedule their arrival at a U.S. port of
entry.

Overview
On January 12, 2023, CBP expanded the CBP One™ application to permit undocumented
individuals seeking to travel to the United States through the southwest border (SWB) land ports
of entry to request an exception from the Centers for Disease Control and Prevention (CDC) Order,
“Suspending the Right to Introduce Certain Persons from Countries Where a Quarantinable
Communicable Disease Exists” (hereafter referred to as Title 42)2 to submit advance information
and to schedule an appointment at certain specified ports of entry. Undocumented individuals, as
well as organizations and entities who provide assistance to undocumented individuals, voluntarily
used the CBP One™ application (mobile and/or desktop) to submit biographic and biometric
information to CBP in advance of their arrival at a port of entry.3 In addition to enabling
undocumented individuals to submit advance arrival information, CBP also offered a designated
number of dates and times at certain ports of entry for undocumented individuals to schedule a
date and time to present themselves at the port of entry for processing.4
1

An undocumented individual is a noncitizen who does not possess a document valid for admission to the United
States. Undocumented individuals may or may not possess a passport or other acceptable document that denotes
identity and citizenship when entering the United States (e.g., passport, passport card; Enhanced Driver’s License;
Trusted Traveler Program card (NEXUS, SENTRI or FAST); U.S. Military identification card; U.S. Merchant
Mariner; American Indian Card, or (when available) Enhanced Tribal Card).
2
On March 20, 2020, the Department of Health and Human Services (HHS) issued an Interim Final Rule (IFR) and
Order under Sections 265 and 268 of Title 42 of the U.S. Code, which permits the Director of the Centers for
Disease Control and Prevention (CDC) to “prohibit […] the introduction” into the United States of individuals when
the Director believes that “there is serious danger of the introduction of [a communicable] disease into the United
States.”9 Section 268 of Title 42 provides that customs officers—which include officers of CBP’s Office of Field
Operations and U.S. Border Patrol agents—shall implement any quarantine rule or regulation issued by the CDC,
which includes Orders under section 265. The Order permits customs officers to except individuals from the CDC
Order in totality of the circumstances based on “consideration of significant law enforcement, officer and public
safety, humanitarian, and public health interests.” On August 2, 2021, the CDC issued an updated Suspending the
Right to Introduce Certain Persons from Countries Where a Quarantinable Communicable Disease Exists, available
at https://www.cdc.gov/coronavirus/2019-ncov/cdcresponse/laws-regulations.html.
3
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE CBP ONETM MOBILE APPLICATION, DHS/CBP/PIA-068
(2021), available at https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
4
CBP released a certain number of date/time slots per port of entry for a given period on a routine basis.

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 2

Upon accessing CBP One™, the user selected the “Submit Advance Information” option
and selected their preferred language. After selecting the language, the user was presented with
the following list of vulnerability criteria:
•

Physical or mental illness;

•

Disability;

•

Pregnancy;

•

No access to safe housing or shelter in Mexico;

•

Under the age of 21;

•

Over the age of 70; or

•

Have been threatened or harmed while in Mexico.

To submit advance information to CBP to schedule an appointment to be considered for an
exception to Title 42, the user was required to attest that they believe that they, or a spouse or child
accompanying them, met the vulnerability criteria.
Once the user attested to the vulnerability criteria, the user was able to submit information
on behalf of themselves and, as appropriate, their spouse and children. To submit information on
behalf of multiple people, the user began by selecting “Add Individual.” Once this was selected,
the user was directed to begin entering their and their spouse’s and children’s biographic and
biometric information, including: name, date of birth, nationality, country/city of birth, country of
residence, phone numbers, U.S. address, foreign addresses (optional), employment history
(optional), travel history (optional), emergency contact information (optional), name/country of
birth and citizenship of mother and father (optional), marital information (optional), non-Western
Hemisphere Travel Initiative (WHTI) compliant5 identity documents (optional), primary language,
gender, height, weight, and eye color.6
Once the user entered all requested information, CBP One™ prompted the user to either
upload a photograph (if using the desktop application) or take a live photo of the undocumented
individual (if using the mobile application). The user was then required to select a desired port of
entry and desired date/time of arrival, when prompted. The user was able to request a date and
time if they were within a specified distance from the U.S.-Mexico border. The purpose of the
5

The types of acceptable Western Hemisphere Travel Initiative compliance documents vary by port of entry type
(i.e., land, air, sea), but generally include U.S. Passport; U.S. Passport Card, Enhanced Driver’s License, Enhanced
Tribal Card, Trusted Traveler Program card (NEXUS, SENTRI or FAST); U.S. Military identification card when
traveling on official orders; U.S. Merchant Mariner document when traveling in conjunction with official maritime
business.
6
The data elements are substantially similar to, and used for the same purposes as, the Form I-94W Nonimmigrant
Visa Waiver Arrival/Departure Record.

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 3

scheduling feature was to assist CBP in properly allocating resources to the ports of entry for a
given day or week to further assist in streamlining processing upon arrival. Once a port of entry
and desired date/time of arrival was selected, the user was able to submit the information to CBP.
Upon submission, the user was presented with a confirmation screen which displayed a
confirmation number along with the selected port of entry and date/time, if applicable. A copy of
the confirmation was also sent to the email address provided as part of the advance information
collection process. The granting of an appointment did not guarantee an exception from the Title
42 order, nor did it guarantee a particular processing disposition. CBP officers make
determinations of whether an exception is authorized, as well as all admissibility determinations,
at the port of entry. CBP officers consider all available information, including information supplied
in advance by the traveler, and the totality of the individual case circumstances to determine the
appropriate processing disposition for each individual.
CBP has made several changes to the CBP One scheduling process since January 12, 2023,
in response to feedback from users and other stakeholders. With this Privacy Impact Assessment
update, CBP is providing transparency regarding another adjustment to the scheduling process in
the post Title 42 environment.

Reason for the PIA Update
On January 30, 2023, in response to a pending bill that would immediately terminate both
the public health emergency and a separate COVID-19 national emergency declared by the
President, the Office of Management and Budget (OMB) issued a statement opposing such an
immediate termination but announcing that “[a]t present, the Administration’s plan is to extend
the emergency declarations to May 11, and then end both emergencies on that date.”7 The currently
operative Title 42 order states that it automatically ends upon the expiration of that declaration.8
Therefore, if the public health emergency declaration expires on May 11, 2023, the Title 42 order
will have expired by its own terms.
Following the termination of the Title 42 order, CBP is returning to processing all
individuals under Title 8 of the U.S. Code. Undocumented individuals will be able to use CBP
One™ to schedule a date and time to be processed at a port of entry. However, such individuals
will not be required to attest to any vulnerability criteria in order to schedule an appointment, as
CBP will process all undocumented individuals arriving at ports of entry, regardless of
vulnerability.9 Based on user and stakeholder feedback, CBP will transition CBP One™
7

OMB, Statement of Administration Policy 1 (Jan. 30, 2023), https://www.whitehouse.gov/wptcontent/uploads/2023/01/SAP-H.R.-382-H.J.-Res.-7.pdf.
8
86 Fed. Reg. 42828, 42830 (August 5, 2021).
9
Additionally, DHS and DOJ are considering publication of a Final Rule that will apply a rebuttable presumption of
asylum ineligibility to noncitizens who, during a temporary period of time, do not use a safe, orderly and lawful

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 4

scheduling to a daily appointment allocation process to allow undocumented individuals additional
time to complete the process.
Effective May 10, 2023, users will no longer be
required to access the application at the same time each day
to select a port of entry to see the availability of
appointments and schedule an appointment. Instead, users
will now be able to request an appointment (for up to 13
days later) once each day at the time that is best for them.
Once the user requests an appointment, they will be put into
a pool of registrations, which will be allocated on a daily
basis. Thus, the user will be notified the following day if
they were allocated an appointment. CBP will use an
algorithm to allocate daily appointments to undocumented
individuals who request an appointment each day. In the
event an individual is not allocated an appointment, they
must request an appointment again to be considered for the
next day’s allocation.
Individuals who are offered an appointment are
notified that they were allocated an appointment through an
email notification, a push notification to the device that
requested the appointment, an in-app message that will
display when they access the app, and an update to their
registration status within the CBP One™ application. After
this notification is sent, the individual is given 23 hours to
confirm the appointment by completing the photo capture and liveness detection process as
described in the original Privacy Impact Assessment.10,11
Any appointment that is not confirmed within the allotted timeframe will be reallocated
pathway to the United States, including use of the CBP One™ application to schedule an appointment to present at a
port of entry, unless the undocumented individual demonstrates by a preponderance of the evidence that it was not
possible to access or use CBP One™ due to a language barrier, illiteracy, significant technical failure, or other
ongoing and serious obstacle; or that the undocumented individual is otherwise not subject to, excepted from, or can
rebut the rebuttable presumption. See https://www.federalregister.gov/documents/2023/02/23/202303718/circumvention-of-lawful-pathways
10
If an individual is experiencing technical difficulties, they are able to request an automatic extension through the
application of another 23 hours. If they still have not resolved their issue, they will need to ask for an appointment
again.
11
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE COLLECTION OF ADVANCE INFORMATION FROM
CERTAIN UNDOCUMENTED INDIVIDUALS ON THE LAND BORDER, DHS/CBP/PIA-076 (2021), available
at https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 5

with the daily allocation for that current day until all appointments are filled up until 3 days from
arrival.12
CBP is also clarifying that collection of family
information and marital status is mandatory rather than
optional. The original Privacy Impact Assessment incorrectly
stated that these were optional fields. The CBP One™
application, however, required individuals to provide
responsive information for these fields and such information
was provided by applicants since issuance of the original
Privacy Impact Assessment. If an individual’s family
members are deceased or unknown, the individual is able to
select those as options. A response to the marital status field
is required (e.g., single, married, widowed).
Finally, as described in the original Privacy Impact
Assessment, at the time the user submits information to CBP
via the CBP One™ mobile application, the GPS on his or her
device is pinged by CBP One™. CBP One™ collects and
sends only the latitude and longitude coordinates at the time
of submission to the CBP One™ mobile application to CBP
for analytical purposes (e.g., to determine where the user is
requesting or confirming an appointment from) and to monitor
irregularities (e.g., receiving multiple submissions from the
same phone), not to conduct surveillance or track user
movement. CBP does not know the location of the user’s
device beyond the moment of submission of the user’s information. Use for surveillance or
tracking purposes is prohibited. Previously, this information was not stored. With this update, CBP
is storing and saving latitude and longitude data for 1 year within the CBP Amazon Web Services
(AWS) Cloud East (CACE) environment. The location information is protected by appropriate
security controls. The latitude and longitude information captured will continue to not be visible
to CBP officers. However, the location information will be used by CBP personnel to monitor
trends to assess resource and/or staffing needs and identify potential vulnerabilities in the
application. The location data is stored in a separate Amazon Web Services Cloud East database
and only associated with a unique confirmation and not associated with a specific device or
individual. CBP will not associate the names of individuals or specific device information with the
location information captured by CBP at the time of submission. If CBP were to use the data for
12

This cutoff is to reduce late notifications for families and individuals to prepare for presentation at the port of
entry.

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 6

other purposes in the future, it will update this Privacy Impact Assessment accordingly.

Privacy Impact Analysis
Authorities and Other Requirements
The legal authorities and System of Records Notice(s) do not change as a result of this
update. This information will be collected on a voluntary basis for the purpose of facilitating and
implementing CBP’s mission. This collection is consistent with DHS and CBP’s authorities,
including under 6 U.S.C. §§ 202 and 211(c). Under these authorities, DHS and CBP are permitted
to maintain the security of the border, including “securing the borders, territorial waters, ports,
terminals, waterways, and air, land, and sea transportation systems of the United States,” and
“implement[ing] screening and targeting capabilities, including the screening, reviewing,
identifying, and prioritizing of passengers and cargo across all international modes of
transportation, both inbound and outbound.” Furthermore, this collection continues to be covered
under the Paperwork Reduction Act (PRA).13 CBP is concurrently updating the Paperwork
Reduction Act package with the publication of this Privacy Impact Assessment.
Characterization of the Information
CBP is continuing to collect the same information as described in the original Privacy
Impact Assessment. With this update, CBP is no longer collecting the vulnerability criteria nor
will users select a time of day for appointments. CBP is also changing the order in which
information is collected. For example, the photograph is not collected until the individual is
allocated an appointment and their preferred port of entry is selected during registration. Finally,
CBP is now storing the location information for 1 year, and it will be used by CBP personnel only
to monitor trends and identify potential vulnerabilities in the application. The location data is not
associated with a specific device or individual.
There are no new privacy risks associated with the voluntary collection of advance
information via CBP One™.
Uses of the Information
This update does not impact the use of information. CBP uses advance information
collected from certain undocumented individuals via CBP One™ to streamline processing upon
arrival at the port of entry. The advance information collection is a combination of biographic and
biometric information. The purpose of this advance collection is to achieve efficiencies in
processing individuals upon their arrival at the port of entry. There are no new privacy risks
associated with the uses of advance information via CBP One™.

13

86 Fed. Reg. 53667 (September 28, 2021).

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 7

Notice
CBP is providing notice of these changes through the publication of this Privacy Impact
Assessment. CBP is also posting public notice of these changes on the CBP website.14 There are
no new privacy risks associated with the notice.
Data Retention by the Project
CBP continues to store the information for the same retention periods as described in the
original Privacy Impact Assessment. As previously described, upon arrival the advance
information is imported into a Unified Secondary (USEC) event and verified, or an Automated
Targeting System (ATS) Unified Passenger (UPAX) event is created during pre-arrival vetting.15
This information will be stored within the Automated Targeting System for 15 years consistent
with the Automated Targeting System retention schedule. In addition, the Unified Secondary event
data will continue to be transmitted into and stored in other systems, where it will be retained in
accordance with the retention schedules for those systems. For example, information that is sent
to and stored in TECS is retained for 75 years in accordance with the TECS retention schedule.16
Many of the forms completed through the Unified Secondary Event (USEC) are sent to the U.S.
Immigration and Customs Enforcement (ICE) Enforcement Integrated Database (EID) as the
source system, in which case they are stored for 75 years.17 With this update, CBP is now also
storing the latitude and longitude information for 1 year within the CBP Amazon Web Services
Cloud East environment.
Privacy Risk: There is a risk that CBP is now storing latitude and longitude information.
Mitigation: This risk is mitigated. Although CBP is now storing this data for 1 year, this
information is not associated with a specific device or individual because the location information
is only collected at the exact time the user submits their information. Instead, this information is
used by CBP personnel to identify trends and potential vulnerabilities with CBP One™.
14

See https://www.cbp.gov/about/mobile-apps-directory/cbpone.
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR UNIFIED SECONDARY, DHS/CBP/PIA-067, available at
https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
16
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE TECS SYSTEM, DHS/CBP/PIA-021 (2016), available at
https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
17
The Enforcement Integrated Database is a DHS shared common database repository used by several DHS law
enforcement and homeland security applications. The Enforcement Integrated Database stores and maintains
information related to the investigation, arrest, booking, detention, and removal of persons encountered during
immigration and criminal law enforcement investigations and operations conducted by ICE, U.S. Citizenship and
Immigration Services (USCIS), and CBP. The Enforcement Integrated Database supports ICE’s processing and
removal of noncitizens from the United States. See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S.
IMMIGRATION AND CUSTOMS ENFORCEMENT, PRIVACY IMPACT ASSESSMENT FOR THE
ENFORCEMENT INTEGRATED DATABASE (EID), DHS/ICE/PIA-015 (2010 and subsequent updates),
available at https://www.dhs.gov/privacydocuments-ice.
15

Privacy Impact Assessment Update
DHS/CBP/PIA-076(a) Post Title 42
Page 8

Furthermore, this information is stored within the CBP Amazon Web Services Cloud East
environment, separate from the personally identifiable information collected through CBP One™.
Information Sharing
There are no changes to information sharing as a result of this update. Information collected
through this process may be ingested into systems that share information on a case-by-case basis
with appropriate federal, state, local, tribal, and foreign governmental agencies or multilateral
governmental organizations responsible for investigating or prosecuting violations of, or for
enforcing or implementing, a statute, rule, regulation, order, or license, or when CBP believes the
information would assist enforcement of civil or criminal laws.
Redress
This update does not impact how access, redress, and correction may be sought through
CBP.
Auditing and Accountability
This update does not impact the auditing and accountability mechanisms in place to ensure
information is used in accordance with stated practices in the original Privacy Impact Assessment
and this Privacy Impact Assessment update.

Contact Official
Matthew Davies
Executive Director
Admissibility and Passenger Programs
Office of Field Operations
U.S. Customs and Border Protection

Responsible Official
Debra L. Danisek
CBP Privacy Officer
Privacy and Diversity Office
U.S. Customs and Border Protection
[email protected]

Approval Signature
Original, signed version on file with the DHS Privacy Office
Mason C. Clutter
Chief Privacy Officer
U.S. Department of Homeland Security
(202) 343-1717