The EU now records the face and fingerprints of millions of non-EU short-stay travellers at its external borders, and a second system will soon require them to obtain an online travel authorisation before they set off. The Entry/Exit System (EES) replaced passport stamping when it became fully operational on 10 April 2026, and the European Travel Information and Authorisation System (ETIAS) is due to follow. Together they create one of the largest biometric identity datasets in the world, operated by eu-LISA, and a new target for travel scams that imitate the official application. This guide sets out what each system is, the dates and phases as the official EU sources state them, what data is collected and for how long, the data protection position, and the practical security issues for travellers, travel managers, carriers and security teams. All dates and figures come from EU and government sources checked on 2 November 2026; ETIAS timings in particular may change, so confirm on the official site before relying on them.
Key takeaways
- EES is live: progressive operations began on 12 October 2025 and the system became fully operational on 10 April 2026, replacing manual passport stamping across 29 participating European countries.
- EES captures biometrics: name, travel document data, fingerprints and a facial image, the date and place of each entry and exit, and refusals of entry; children under 12 are exempt from fingerprinting.
- ETIAS has not started yet: the EU describes it as scheduled for the last quarter of 2026 with the date announced months in advance, a fee of EUR 20 and validity of up to three years.
- There is only one official ETIAS website and app: government sources warn that unofficial ETIAS websites already exist, so lookalike sites charging extra fees or harvesting passport data are the main consumer risk.
- Biometric border data is special category data: retention is time-limited (three years for most records, five years for overstayers), law enforcement access is restricted to designated authorities, and travellers have rights of access and correction.
What the two systems are
| Entry/Exit System (EES) | ETIAS | |
|---|---|---|
| Purpose | Automated register of non-EU nationals travelling for a short stay, recorded each time they cross an external border | Pre-travel authorisation for visa-exempt travellers, screening for security, irregular migration or high epidemic risk before travel |
| Who it applies to | Non-EU nationals on short stays, both visa-required and visa-exempt | Visa-free travellers visiting 30 European countries for a short stay (up to 90 days in any 180-day period) |
| Where it happens | At the border: self-service kiosks or a border guard capture data | Online, through the official website or app, before travel |
| Legal basis | Regulation (EU) 2017/2226, with Regulation (EU) 2025/1534 for the progressive start | Regulation (EU) 2018/1240 |
| Status (2 Nov 2026) | Fully operational since 10 April 2026 | Not in operation in the sources checked; scheduled for the last quarter of 2026 |
| Cost to traveller | None | EUR 20 fee (waived for applicants under 18 or over 70 under the regulation) |
| Who builds and runs it | eu-LISA | eu-LISA (information system); ETIAS Central Unit within the European Border and Coast Guard Agency (Frontex) |
ETIAS is not a visa. Government guidance is explicit that it does not guarantee entry: travellers still pass through border control, and EES records the crossing.
EES timeline and phases
The European Commission's Home Affairs pages give this sequence:
| Date | Milestone |
|---|---|
| 6 April 2016 | Commission proposes the EES as part of the revised Smart Borders Package |
| 20 November 2017 | EES Regulation and a targeted amendment of the Schengen Borders Code adopted |
| 29 December 2017 | Those measures enter into force |
| 4 December 2024 | Commission proposes a progressive start of operations |
| 18 July 2025 | Regulation (EU) 2025/1534 adopted, setting temporary derogations for the progressive start; in force 26 July 2025 |
| 30 July 2025 | Commission sets 12 October 2025 as the launch date |
| 12 October 2025 | Progressive start of operations at external borders |
| 10 April 2026 | EES fully operational; replaces the stamping of passports |
The progressive start mattered operationally because border crossing points moved onto the system in stages, so travellers during that window could meet both stamping and biometric registration. Since 10 April 2026 the electronic record is the reference for calculating the permitted stay. The regulation provides an automated calculator for the 90 in 180 day rule and a mechanism that identifies overstayers automatically once the authorised stay has expired.
What EES collects
| Data | Detail from the regulation and Commission pages |
|---|---|
| Identity and travel document | Name, travel document data, nationality; a file is created per traveller on first crossing |
| Facial image | Normally taken live at the border; in exceptional cases extracted from the passport chip, only after electronic verification against a live image (Article 15) |
| Fingerprints | For visa-exempt travellers: four fingerprints (index, middle, ring and little finger) of the right hand where present, otherwise the left (Article 3(16)); visa holders' files hold identity, travel document data and a facial image, with the EES interoperable with the Visa Information System (Article 8) |
| Exemptions | Children under the age of 12 are exempt from giving fingerprints; people for whom fingerprinting is physically impossible are exempt, with temporary impossibility recorded (Article 17) |
| Movements | Date and place of each entry and exit |
| Refusals | Refusals of entry (Article 18) |
When capturing a child's data, the regulation states that the best interests of the child are a primary consideration (Article 10(2)). Fallback procedures cover border crossings when the system fails (Article 21), which matters for resilience planning at ports and airports.
Retention
- Three years: records of travellers who respected their authorised stay, and of those refused entry, are kept for three years for border management purposes (recital 32 of Regulation 2017/2226).
- Five years: records of people who did not exit within the authorised stay are kept for five years to support identification and return (recital 33).
- Up to one year: coupled entry and exit records of certain family members of EU citizens without a residence card are kept for a maximum of one year after exit.
- Automatic erasure: the regulation provides for data to be erased automatically when the period expires. National copies retrieved from the system may only be kept where necessary in an individual case and no longer than strictly necessary (Article 28).
ETIAS: what is confirmed and what is not
ETIAS dates have moved several times, so precision matters here. The Commission's Home Affairs page (last updated 6 October 2025) states that ETIAS is not in operation, that no applications are being collected, and that the EU will announce the start date several months before launch. The EU Delegation to the United States page (updated July 2025) states that ETIAS is scheduled for the last quarter of 2026 and that the exact date will be announced at least six months before operations begin. Check travel-europe.europa.eu for the current position.
| Point | What the official sources state |
|---|---|
| Fee | EUR 20, increased from the EUR 7 set in the 2018 regulation; Home Affairs notes the new fee takes effect once ETIAS is operational |
| Fee waiver | Applicants under 18 or over 70 at the time of application (Article 18 of Regulation 2018/1240) |
| Validity | Three years, or until the travel document expires, whichever comes first (EU Delegation to the US) |
| Application data | Names, date and place of birth, nationality, travel document details, address, email, education, occupation, first intended country of stay, plus questions on criminal convictions, stays in conflict zones and past return decisions; the IP address used is recorded (Article 17) |
| Processing | Most applications processed within minutes according to Norwegian Police guidance; where manual processing by the ETIAS Central Unit is needed it must be completed within 12 hours of receipt (Article 22(6)) |
| Retention | Application files are kept for the validity of the authorisation, or five years after a refusal, annulment or revocation; up to three further years only with the applicant's explicit consent (Article 54, as referenced in Article 24(6)(c)) |
| Carriers | Transport companies must verify that passengers hold a valid authorisation before boarding |
| Intermediaries | Travellers may authorise a third party to apply for them; the EU Delegation advises checking service quality, extra charges and data protection first |
The regulation also provides for a transitional period and a grace period after launch, which the Commission can extend by delegated act. The sources checked did not state their durations for the current timetable, so this guide does not give them.
Travel scams: fake ETIAS and EES sites
The Norwegian Police state that several unofficial ETIAS websites exist and that there is only one official ETIAS website, at travel-europe.europa.eu/etias. This is the same pattern seen with other electronic travel authorisations: lookalike domains and paid search adverts that charge a large "processing" fee for a form the traveller could submit for EUR 20, or that collect passport scans and card details for fraud.
- Before launch, any site taking ETIAS applications is not official: the EU states that no applications are collected until the system starts.
- Check the domain: the official site sits under europa.eu. Domains containing "etias" with other suffixes are not EU sites, however official they look. See the Typosquatting and Lookalike Domains Guide.
- EES needs no pre-registration: registration happens at the border, so any website or message asking travellers to "pre-register for EES" or pay an EES fee is a scam.
- Intermediaries are lawful but optional: a legitimate agent should state its own fee separately from the EU fee and explain how it handles passport data.
- Phishing follow-ups: expect emails and texts claiming an ETIAS application is "incomplete" or "refused" with a payment link. Official decisions arrive through the official channel; check status there, not via links.
- If someone has paid a fake site: contact the card issuer, change any reused passwords, and watch for identity misuse of the passport details. The What to Do If You Have Been Scammed Guide and the Consumer Reporting Routes Map cover reporting.
Data protection and identity risks
Fingerprints and facial images used to identify a person are biometric data, a special category under the GDPR, and the EES and ETIAS regulations set their own purpose limits, access rules and retention on top. For security and privacy teams, four issues stand out.
- Purpose and access limits: law enforcement access to EES is restricted. Member States designate authorities and central access points, Europol has its own designated authority, and requests go through a central access point with a separate urgent procedure only for imminent threats to life (Articles 29 to 31). Serious criminal offence is defined as one punishable by a maximum of at least three years' custody (Article 3(25)).
- Accuracy and errors: a wrong exit record can make a compliant traveller appear to be an overstayer. The regulation lets travellers rebut the overstay presumption (Article 20) and gives rights of access, rectification and erasure; keep boarding passes and other evidence of exit.
- Biometric matching and presentation attacks: self-service kiosks depend on face matching and liveness. The general controls are covered in the Biometric Liveness and Presentation Attack Detection Guide.
- Concentration risk: a central biometric dataset covering what eu-LISA estimates at roughly 1.3 billion travellers a year is a high-value target. Biometric data cannot be reissued like a password, which is why access control, logging and supervision of these systems matter more than for most datasets. See the Biometrics Guide.
What organisations need to do
| Organisation | EES impact | ETIAS impact |
|---|---|---|
| Airlines, ferry, rail and coach operators | Longer processing at some crossings on first registration; plan connection times and passenger messaging | Carrier obligation to verify a valid authorisation before boarding; integrate verification into check-in and handle failures |
| Corporate travel and HR (non-EU staff) | Accurate stay calculation now automated; staff near the 90 in 180 day limit will be flagged | Budget the fee and lead time; tell travellers to use only the official site |
| Travel agents and intermediaries | Customer guidance | If applying on behalf of travellers, treat passport and application data as sensitive, disclose fees, and secure the accounts used |
| Security and fraud teams | Fallback and outage planning at border infrastructure operators | Monitor for lookalike domains abusing your brand alongside ETIAS, and warn customers before launch |
A short rollout plan for travel-facing organisations
- Confirm current status: check the official EU EES and ETIAS pages and record the date checked; do not rely on press coverage for dates.
- Update traveller guidance: one page stating that EES is at the border with no fee, and that ETIAS applications go only through the official site or app once launched.
- Pilot carrier checks: where ETIAS verification applies, test it on a limited route set before launch day and define what staff do when verification fails.
- Brief contact centres: give scripts for travellers who paid a fake site or were told they are overstayers in error.
- Monitor and adjust: track scam reports and boarding refusals in the first months, and update guidance when the transitional and grace periods are confirmed.
Measuring whether guidance works
- Share of travellers who used the official ETIAS channel, from booking surveys or agent records.
- Number of customer reports of fake ETIAS or EES sites, and time to warn customers after a new one is seen.
- Boarding refusals or delays attributed to missing or invalid authorisations once ETIAS is live.
- Contact centre cases about disputed EES stay calculations and how many were resolved with exit evidence.
Common failure patterns
- Quoting dates from press articles: ETIAS has been postponed more than once; only the EU's own pages are reliable, and even they carry an "announced in advance" caveat.
- Using the old EUR 7 fee: the 2018 regulation says EUR 7, but the Commission states the fee is EUR 20.
- Clicking the first search advert: paid adverts for unofficial sites often sit above the official result.
- Assuming EES needs action before travel: it does not, which is exactly what "EES pre-registration" scams exploit.
- Treating ETIAS as a visa: it does not guarantee entry, and an approved traveller can still be refused at the border.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| Regulation (EU) 2017/2226 (EES) | Articles 15, 17, 18, 20, 21, 28, 29 to 31; recitals 32 and 33 on retention | Data captured, exemptions, fallback, law enforcement access, retention |
| Regulation (EU) 2025/1534 | Temporary derogations for the progressive start | Legal basis for the 12 October 2025 to 10 April 2026 phase |
| Regulation (EU) 2018/1240 (ETIAS) | Articles 6, 7, 17, 18, 22, 24, 54 | eu-LISA and Central Unit roles, application data, fee, processing, retention |
| GDPR | Article 9 (special categories, including biometric data for identification) | Applies to organisations handling passport and biometric data, such as intermediaries |
| ISO/IEC 27001:2022 Annex A | A.5.34 Privacy and protection of PII | Controls for travel companies handling applicant data |
Practitioner checklist
- Record the official EES and ETIAS status and the date you checked it in any traveller guidance.
- State plainly that EES has no fee and no pre-registration, and that ETIAS uses one official website and app.
- Link only to travel-europe.europa.eu for applications; never to third-party sites.
- If you act as an intermediary, disclose your fee, protect passport data as sensitive personal data and secure the accounts you use.
- Carriers: build and test ETIAS verification and failure handling before launch.
- Monitor for lookalike ETIAS domains that use your brand and request takedowns.
- Tell non-EU staff to keep proof of exit in case an EES record is disputed.
- Review guidance again once the ETIAS start date, transitional and grace periods are published.
Standards and references
- EUR-Lex: Regulation (EU) 2017/2226 establishing the Entry/Exit System
- EUR-Lex: Regulation (EU) 2018/1240 establishing ETIAS
- European Commission Home Affairs: Entry/Exit System
- European Commission Home Affairs: ETIAS
- eu-LISA: Entry/Exit System
- EU Delegation to the United States: Travelling to Europe (ETIAS)
- Norwegian Police: ETIAS
Related NHI Mgmt Group resources: Travel Cybersecurity Guide · Biometrics Guide · Typosquatting and Lookalike Domains Guide · GDPR Compliance Guide for Security Teams. This guide summarises the EU Entry/Exit System and ETIAS rules as published by EU institutions and is not legal advice.