An office inside the White House is operating citizen-facing federal systems outside normal disclosure requirements.
Executive Order 14338 created the National Design Studio inside the White House Office, reporting to the White House Chief of Staff and not to an agency. It has since registered and operated citizen-facing federal domains, including passports.gov and a preview of vote.gov, and deployed visitor tracking on public federal websites.
We found no published Privacy Impact Assessment or System of Records Notice for the Studio or its programs. Whether those filings were legally required turns in part on whether the Studio is an “agency,” a question no court has decided for this office and for which we have found no written executive branch position.
Eight things that are on the record.
The Studio sits inside the Executive Office of the President
A temporary organization under 5 U.S.C. § 3161, with its Administrator reporting to the Office of the White House Chief of Staff. Its leadership required no Senate confirmation and no financial disclosure. It closes around August 2028; what it builds does not.
passports.gov is registered to the Executive Office of the President, not the Department of State
It presents a sign-in page with no agency seal and no privacy notice, and the .gov registry security contact field is blank. Two biometric photo-upload subdomains were created within one hour on May 26, 2026.
A working preview of vote.gov was registered to the Executive Office of the President
Certificate logged April 10, 2026. The live vote.gov belongs to the Election Assistance Commission, which Congress established as an independent bipartisan body after the 2000 Florida recount.
Studio-run federal sites carried session-recording software
The documented configuration did not strip IP addresses and used proxy routing that could bypass tracker blocking. A Federal Register search returns no System of Records Notice for the Studio or its programs.
A federal court found the related SAVE expansion unlawful
DHS and SSA expanded the SAVE program to screen registered voters and published a modified System of Records Notice on October 31, 2025, after the expanded system was operating. On June 22, 2026, Judge Sparkle L. Sooknanan held that the expansion violated the Privacy Act, Social Security Act, and Administrative Procedure Act, and that the agencies lacked statutory authority for parts of the program. By then, it had screened more than 67 million registered voters.
Studio-built sites have failed federal accessibility standards
Independent reviewers, including a former 18F engineer and named accessibility specialists, identified Section 508 and WCAG problems on Studio sites. RealFood.gov carried a notice stating that its content was undergoing a Section 508 review after launch. The Studio does not sit inside an agency with its own inspector general and established digital review process.
The reporting deadline in the executive order passed with nothing published
EO 14338 § 3 required agency heads to produce initial results by July 4, 2026. No public accounting has appeared from any agency.
The agency responsible for vote.gov lost all of its commissioners
On July 9, 2026, President Trump removed Commissioners Thomas Hicks and Benjamin Hovland, while Commissioner Christy McCormick resigned. The Election Assistance Commission was left with no commissioners shortly after telling reporters that the Studio's vote.gov modernization project was paused and that the live site remained under EAC control.
Eight questions, sorted by the desk that owes the answer.
The Studio and White House Counsel
Does the National Design Studio consider itself an agency subject to the Freedom of Information Act and the Privacy Act? If not, on what authority, and does it consider its records to be Presidential records under 44 U.S.C. § 2201?
Who holds the credentials for the Cloudflare account gating Studio preview environments? Is it a government account or a personal one, and who pays for it?
Who sits on the National Design Studio advisory council, under what charter, and has the Federal Advisory Committee Act been considered? Gebbia named Scott Belsky as chair publicly; no membership or charter has been published.
OMB and GSA
What appropriation funds the Studio, and under what account? No contracts appear in USASpending.gov and no line item has been identified.
What data does visitor tracking on Studio-operated federal sites collect, where is it stored, who can access it, and what is the retention period?
State Department and FBI
Was a Privacy Impact Assessment prepared for passports.gov or for any system collecting information from the public through a Studio-operated domain? If so, why is none published? If not, what determination was made that section 208 of the E-Government Act did not apply?
What is the staging environment identified in certificate logs as fbi-kirk-tipline.previews.ndstudio.gov? Who requested it, what does it collect, and is the FBI aware of it?
Every agency named in EO 14338
Which agencies produced the initial results required by EO 14338 § 3 by July 4, 2026, and will those be made public?
Who already has the authority to ask.
Broad executive branch oversight, federal information policy, privacy, and government technology.
Broad federal government oversight, information management, privacy, and cybersecurity. The committee has already examined DOGE data handling.
Federal election administration and oversight involving the Election Assistance Commission.
Federal election administration and Election Assistance Commission oversight.
The Financial Services and General Government subcommittees oversee funding for the Executive Office of the President.
FOIA and Privacy Act issues, as well as questions involving FBI infrastructure.
State Department oversight, including passport-related questions.
A member of Congress can request GAO work examining federal operations, privacy compliance, or the Studio's funding basis.
No document here shows intent, and no court has found a violation by the Studio.
Everything above concerns structure, placement, timing, and absent paperwork. No court or federal authority has found that the Studio violated federal privacy law.
has said Studio personnel comply with all legal requirements.
has said the vote.gov project is paused and the live site remains under its control and unconnected to White House systems.
has said it works closely with the White House on passport services while maintaining security.
An office inside the White House, without the normal agency structure around inspector general oversight and privacy review, and with unresolved FOIA status, is building or operating systems Americans use to register to vote, obtain passports, and prove their identity.
That is worth examining regardless of who holds the office or what they intended. The concern is about how the office was structured and what oversight exists around the systems it builds.
Sourcing and contact
Most technical findings here originate with Audrey Henson at The Drey Dossier (27 May 2026), with additional reporting and confirmation by The Guardian (June 2026) and earlier personnel reporting by Wired. AltNDS compiles, dates, verifies, and sources the record.