A secretive White House office staffed by veterans of Elon Musk's government efficiency initiative has rebuilt some of the nation's most sensitive federal websites while installing commercial surveillance tools that appear to violate privacy laws, according to investigative reporting.
The National Design Studio, created by executive order in August 2025 and led by Airbnb co-founder Joe Gebbia, operates federal portals for passport applications, voter registration, prescription drug pricing, and children's savings accounts. An examination of the underlying website code found that at least two of the studio's four main sites contain PostHog, a commercial tracking tool configured to record every click, scroll, and keystroke visitors make.
The tracking software has been set up to circumvent standard privacy protections. Most ad blockers and privacy tools work by identifying requests to known tracking services and blocking them before data leaves a user's device. The studio configured PostHog to route its analytics through the federal website itself rather than PostHog's own servers, making the tracking invisible to privacy software. PostHog's own documentation describes this technique as effective precisely because "ad blockers haven't visited your domain to catalog your setup."
None of the four websites operated by the studio carry the required public filings mandated under the Privacy Act of 1974 and the E-Government Act of 2002. Additionally, the studio's spending and vendor arrangements do not appear in USAspending, the federal contracting database, raising questions about oversight and funding mechanisms.
The studio has also created duplicate versions of services that federal law assigns to other agencies. It operates its own passport application portal that bypasses the State Department's existing site and maintains a copy of vote.gov, the federal voter registration site that should be controlled by an independent bipartisan commission. This White House-controlled version of the voter registration system is accessible only with a White House login.
The implications concern privacy advocates. A federal voter registration database operated from the White House could allow the administration to see who is registering or check registration status in the weeks before an election. The system could also route identity and citizenship verification through infrastructure the administration controls.
John Davisson, senior counsel at the Electronic Privacy Information Center, described the studio's approach as creating "a whole sort of second skunk-works version of the federal government with all these shady tracking technologies and outside of the parameters of normal federal privacy law."
The National Design Studio occupies an unusual position within the executive branch. It operates as a "temporary organization" within the Executive Office of the President, a designation that places it outside the Senate confirmation process, financial disclosure requirements, and the inspector general's jurisdiction that covers cabinet departments. The studio is staffed using the same hiring authority that governed the government efficiency department, keeping its personnel roster off the standard federal financial-disclosure system.
Gebbia, who became a multibillionaire from Airbnb's founding and serves as chief design officer of the United States, had previously been a Democratic donor before announcing his support for Trump in January 2025. He spent six months leading a digitization initiative at the government efficiency department before moving to the design studio. At least two other figures with backgrounds at that department work alongside him, including Greg Hogan, who reportedly oversees Login.gov, the federal sign-in system used by more than 150 million Americans.
The Guardian contacted the White House with detailed questions about the studio's operations on June 4. On June 17, White House spokesperson Liz Huston responded that "all National Design Studio personnel comply with all legal requirements in their important work to improve how citizens interact with their government." The tracking software was apparently removed from the websites after the inquiry.
Serge Egelman, research director of the Usable Security and Privacy Group at the International Computer Science Institute, pointed to parallels with a previous case involving Meta Pixel being placed on the California Department of Motor Vehicles website. "It's not like someone going to the DMV website expects a private company to receive their personal data and then be allowed to use that however they want," he said.
Author James Rodriguez: "This is exactly the kind of shadow government infrastructure that erodes trust faster than any policy announcement ever could."
Comments