A date you will see quoted. Advocacy material on this subject frequently states that Studio records are "sealed until 2040." No provision of the PRA produces that year. The figures the statute actually supports are 2034 for the opening of FOIA access and 2041 for the lapse of restrictions. Both assume these are presidential records, not agency records, which is the unresolved question above. The shape of the concern is right. The number is not.
Everything we claim, and where it comes from.
Written for the reader who assumes we are wrong. Every documented claim names its source, every open question is labeled as one, and the unresolved legal question over whether the missing filings were required is laid out in full.
Is the Studio an agency, or is it the President's staff?
Nearly every disclosure obligation discussed on this site turns on one question, and it has not been answered for the National Design Studio. Offices inside the Executive Office of the President are not automatically subject to FOIA, the Privacy Act, or the E-Government Act's Privacy Impact Assessment requirement.
Under Soucie v. David (1971), an EOP unit is a FOIA agency only if it exercises substantial authority independent of the President. The D.C. Circuit held that the NSC fails that test in Armstrong(1996) and reached the same result for the Office of Administration in CREW (2009).
Why this cuts both ways
The same facts that make the Studio look unaccountable are also the facts that could make it accountable. It cannot comfortably be both.
IF IT ONLY ADVISES
EO 14338 says the Studio “shall advise agencies.” On that reading, it is presidential staff, outside FOIA and the Privacy Act, and no Privacy Impact Assessment was required. Its records are presidential records under the PRA.
IF IT OPERATES SYSTEMS
Registering federal domains, running Login.gov work, and deploying data collection on public-facing sites look like independent operational authority, not advice. On that reading, the Studio is an agency. The missing Privacy Impact Assessments and System of Records Notices become a genuine compliance failure, and its records are agency records subject to FOIA now.
Our position, stated as a position: the operational facts point toward agency status. We think an office that owns citizen-facing domains and deploys telemetry on them is doing more than advising. We also think this is exactly the kind of question a court decides, not us, and no court has decided it here. Anyone who tells you the answer is obvious, in either direction, is skipping the hard part.
What the Presidential Records Act actually does
If the Studio's records are presidential records, here is the real timetable. It is more complicated and in some ways worse, than the single sealed-until date that has circulated.
Years 0–5
Presidential records are not publicly available at all while the Archivist processes them.
44 U.S.C. §§ 2201–22092034
After five years, the public may file FOIA requests for records that are not exempt. For an administration ending January 2029, that is January 2034.
44 U.S.C. § 2208 · NARA guidance2041
A departing president may restrict six specified categories of records for a period not exceeding twelve years. Every president since Reagan has chosen the full twelve.
44 U.S.C. § 2204 · 36 C.F.R. § 1270.40After 2041
PRA restrictions lapse entirely, though FOIA exemptions may still apply.
CRS Report R46129What we can document
Twenty claims we will stand behind, each with the record it rests on. Nothing here depends on the legal question above.
DOCUMENTED20
01
The National Design Studio was created by EO 14338 on August 21, 2025, sits within the White House Office, and is a temporary organization under 5 U.S.C. § 3161 set to close three years from signing.
EO 14338 · 90 Fed. Reg. 41759
02
Its Administrator reports to the Office of the White House Chief of Staff, not to any agency head, and its leadership required no Senate confirmation.
EO 14338 § 2(b) · Reuters
03
Joe Gebbia, previously of DOGE and a co-founder of Airbnb, was named the first Chief Design Officer of the United States.
Bloomberg · Fox Business · joegebbia.com
04
GSA eliminated 18F on February 28–March 1, 2025, cutting a technology office of roughly 90 people. Eighty former employees later filed a class appeal with the Merit Systems Protection Board.
Nextgov/FCW · Federal News Network
05
Former DOGE personnel moved into the Studio, including Kaitlyn Koller, a former Senate Foreign Relations Committee aide.
Wired · NOTUS
06
A working preview of vote.gov was registered to the Executive Office of the President with a certificate logged April 10, 2026. The live vote.gov belongs to the Election Assistance Commission.
Certificate Transparency logs · The Drey Dossier
07
Executive Order 14399 directed DHS and SSA to compile Confirmed Citizen Lists and gave DHS until June 29, 2026 to establish the infrastructure. DHS approved the build plan on June 8, 2026.
EO 14399, 91 Fed. Reg. 17125 · Notice to court, D. Mass. [Doc. No. 188]
08
On June 22, 2026 a federal judge held the expanded SAVE system unlawful, finding violations of the Privacy Act, the Social Security Act, and the Administrative Procedure Act, and no statutory authority to build it. The system had by then screened more than 67 million registered voters.
D.D.C. opinion (Sooknanan, J.) · NPR · CBS News · Democracy Docket
09
DHS and SSA published the required System of Records Notice for the expanded SAVE program on October 31, 2025 after the system was operating and days after the first hearing in the suit challenging it.
90 Fed. Reg. 48948 (31 Oct 2025) · Democracy Docket
10
On July 9, 2026 the President removed the three remaining Election Assistance Commission members (Thomas Hicks, Benjamin Hovland, and Christy McCormick) leaving the agency that owns vote.gov without a quorum eleven days after it told reporters the Studio's modernization project was paused.
Votebeat · Democracy Docket · States United Democracy Center
11
Passports.gov is registered to the Executive Office of the President, not the State Department. Its security contact field is blank. Two photo upload subdomains were created within one hour on May 26, 2026.
CISA .gov registry · Certificate Transparency logs
12
PostHog session recording was documented on Studio-run federal sites with IP addresses not stripped, using a reverse proxy that defeats tracker blocking.
The Drey Dossier · The Guardian
13
The Studio apparently removed that tracking software after the Guardian sent the White House a detailed series of questions on June 4, 2026. Spokesperson Liz Huston responded on June 17 that all Studio personnel comply with all legal requirements.
The Guardian
14
A custom script of roughly 540 lines, served from Studio infrastructure, generates session identifiers and posts telemetry to a Studio analytics endpoint.
The Drey Dossier
15
A Federal Register search for the National Design Studio returns no published System of Records Notices, and we found no published Privacy Impact Assessments for the twelve programs.
AltNDS Federal Register search, 28 Jul 2026
16
Roughly 40 unannounced Studio subdomains appear in certificate logs, all registered to the Executive Office of the President and gated behind a single private Cloudflare account named “loveisaskill.”
crt.sh · The Drey Dossier infrastructure map
17
Greg Hogan, former OPM Chief Information Officer, was one of three people granted exceptions to the injunction barring DOGE personnel from OPM records, and now leads Login.gov work.
AFSCME v. SSA · Nextgov/FCW
18
Multiple independent reviewers, including a former 18F engineer and named accessibility specialists, have found Studio-built sites fail Section 508 / WCAG standards. RealFood.gov carries a live notice stating its content is undergoing a Section 508 review after it was already launched.
NOTUS (Dec 2025) · Nextgov/FCW and Government Executive (Feb 2026)
19
The Studio has an advisory council chaired by Scott Belsky, referenced by Gebbia on a podcast. No membership list, charter, or meeting notices have been published, and the Studio declined to provide details.
Nextgov/FCW · Government Executive (Feb 2026)
20
EO 14338 required agencies to produce initial results by July 4, 2026. We have found no public accounting from any agency as of July 28, 2026.
EO 14338 § 3 · AltNDS records search
Things we can't answer
Each one lists the specific record, filing, or person that would settle it. Several are within reach of an ordinary reader.
NO.THE QUESTIONWHO CAN CLOSE IT
01
How do the Justice Department's representation to the court and the April 10 certificate fit together? A misstatement to a court, a gap between the Studio and the agencies named in the order, and a difference in what counts as “preparation” are all possible explanations, and we cannot distinguish between them from outside.
the filing itself, or a court
02
Who funds the Studio, and under what appropriation? We found no contracts in USASpending.gov and no line item we can identify. A temporary organization under § 3161 still has to be paid for out of something.
appropriations records, OMB apportionment data
↳ ANYONE CAN CHECK THIS
03
What does the AutoMonitor script collect, where does the telemetry go, and how long is it retained? The file is publicly served and anyone who reads JavaScript can check.
anyone
04
What happens to PostHog session recordings from federal health, passport, and voter-facing sites? Where is that data stored, who can query it, and is it inside a government boundary or a vendor's?
a contract, a DPA, or a PostHog disclosure
05
Who controls the “loveisaskill” Cloudflare account? Is it a personal account, a government account with a personal name, or something in between? The answer determines whether federal infrastructure sits behind private credentials.
Cloudflare billing records, GSA IT inventory
06
What is fbi-kirk-tipline.previews.ndstudio.gov? Who requested it, what does it collect, who receives submissions, and is the FBI aware that a staging environment carrying its name exists on White House infrastructure?
FBI, the Studio, or a records request
07
Which outside vendors and contractors are building Studio systems? The executive order contemplates consulting outside design firms, and Wired reported contracts with private studios, but we have no vendor list.
procurement records, FPDS
↳ ANYONE CAN CHECK THIS
08
Did any agency produce the initial results EO 14338 required by July 4, 2026? If they were produced and simply not published, that is a different story than if they were never produced.
any agency, or a congressional letter
09
Has the Studio taken the position, in writing, that it is not subject to FOIA? Agencies usually put this in a response letter. That letter would tell us which side of the Armstrong test they think they are on.
anyone who has filed a FOIA request and received a denial
↳ ANYONE CAN CHECK THIS
10
What is Edward Coristine's current role, if any? Photos and video on the Studio's site appear to show him as staff, which is weaker evidence than a personnel record.
the Studio, or a payroll record
Sources
Executive Order 14338 (21 Aug 2025)
90 Fed. Reg. 41759. Establishes America by Design and the Studio within the White House Office. Sets the § 3161 temporary organization, the Chief of Staff reporting line, the July 4, 2026 agency reporting deadline, and the three-year sunset.
Executive Order 14399 (31 Mar 2026)
91 Fed. Reg. 17125. “Ensuring Citizenship Verification and Integrity in Federal Elections.” Directs DHS and SSA to compile Confirmed Citizen Lists; § 4(c) sets a June 29, 2026 infrastructure deadline. Also directs USPS rulemaking on ballot envelope identifiers.
Federal Register SORN search
A search for “National Design Studio” returns no published System of Records Notices as of July 28, 2026.
CISA .gov registry
Public registry of federal domains. Shows ndstudio.gov, passports.gov, realfood.gov, and trumprx.gov registered to the Executive Office of the President, and lists an ndstudio.gov address as security contact for usadf.gov.
5 U.S.C. § 3161
The temporary organization hiring authority used by both DOGE and the Studio. Permits term appointments outside the competitive service.
44 U.S.C. §§ 2201–2209
The Presidential Records Act, including § 2204 on restriction categories and § 2208 on FOIA access.
E-Government Act of 2002 § 208
Requires a Privacy Impact Assessment before developing or procuring systems that collect identifiable information from the public. Applies to agencies, which is the contested question here.
The Guardian (Jun 2026)
Studio staffing, infrastructure routing through White House systems, visitor tracking, funding opacity. Obtained the White House, EAC, and State Department responses.
Wired
Identified former DOGE personnel moving into the Studio. Reported that Gebbia was originally headed to the DOGE Service but sought his own office. Documented outside design contracts.
Reuters
Gebbia's appointment and the reporting line to the Chief of Staff.
Bloomberg
Gebbia's appointment and the reporting line to the Chief of Staff.
Nextgov
The 18F elimination and headcount. Studio recruiting and the 27,000-website target.
FCW
The 18F elimination and headcount. Studio recruiting and the 27,000-website target.
Federal News Network
The MSPB class appeal by 80 former 18F employees. Studio hiring.
New York Times
The Borges whistleblower complaint and the NUMIDENT cloud upload.
CSO Online
The Borges whistleblower complaint and the NUMIDENT cloud upload.
Associated Press
Election executive order coverage and court filings.
The Drey Dossier, “I found a second vote.gov” (27 May 2026)
Audrey Henson's primary investigation, using certificate transparency logs, browser network inspection, and CISA registry data. The origin of most of the technical findings on this site.
NDS infrastructure map
A live public map of every Studio subdomain identified, maintained on GitHub.
Passports.gov follow-up (10 Jun 2026)
Documents the photo upload system on White House infrastructure with no State Department involvement and no privacy filings.
Certificate Transparency logs (crt.sh)
Public, append-only logs of every TLS certificate issued. The source for every date on this site. Anyone can search ndstudio.gov and see the same records we did. Roughly 40 distinct unannounced hostnames, including vote-gov.previews and fbi-kirk-tipline.previews.
PostHog deployment
Found on trumprx.gov, realfood.gov, trumpaccounts.gov, and ndstudio.gov. IP addresses not stripped. Reverse-proxy routing defeats tracker blocking. Visible in any browser's network inspector.
AutoMonitor script
~540 lines of custom JavaScript at cdn.infra.ndstudio.gov, posting to analytics.infra.ndstudio.gov.
loveisaskill.cloudflareaccess.com
The single Cloudflare Access account gating the Studio's preview sites.
AFSCME v. SSA
Preliminary injunction blocking DOGE personnel from OPM personnel records. Greg Hogan was one of three granted exceptions.
AFT v. Bessent
Challenge to DOGE access to Treasury and IRS systems. Documents which systems engineers were granted read and write access to.
Borges whistleblower disclosure (Aug 2025)
SSA chief data officer's complaint alleging DOGE personnel uploaded NUMIDENT to a cloud environment without verified security controls.
Senate HSGAC minority report (Sep 2025)
Committee Democratic staff report on DOGE data handling. States that upload authorization was apparently granted by Michael Russo and Aram Moghaddassi.
D.D.C. ruling on the SAVE overhaul (22 Jun 2026)
Judge Sparkle L. Sooknanan's 75-page decision holding the expanded SAVE system unlawful under the Privacy Act, Social Security Act, and APA. Central to this site: the court found agencies built first and filed the required notices only under litigation pressure.
League of Women Voters of Massachusetts v. Trump (D. Mass.)
Challenge to Sections 2 and 3 of EO 14399. Memorandum and Order issued July 22, 2026.
State attorneys general suit (3 Apr 2026)
Twenty-three attorneys general and the governor of Pennsylvania challenging EO 14399.
The reported DOJ representation
The Drey Dossier reports DOJ told a court the named agencies had not begun preparations. We have not located this filing and do not rely on it. If you can identify the case and docket number, that closes our largest remaining gap.
Soucie v. David, 448 F.2d 1067 (D.C. Cir. 1971)
Established that an EOP unit is a FOIA agency if it exercises authority beyond advising the President.
Armstrong v. Executive Office of the President, 90 F.3d 553 (D.C. Cir. 1996)
Held the National Security Council is not a FOIA agency because it lacks substantial independent authority.
CREW v. Office of Administration, 566 F.3d 219 (D.C. Cir. 2009)
Same result for the White House Office of Administration. The closest precedent to the Studio's likely position.
CRS Report R46129
Congressional Research Service overview of the Presidential Records Act, including the five-year and twelve-year access timelines.
What would change our mind
We would drop the central concern on this site if three things happened. None of them requires resolving the legal question. They just require doing the thing the filings exist to accomplish.
Publish the assessments
Privacy Impact Assessments for the Studio's public-facing systems, filed where anyone can read them.
Transfer the domains
Move the citizen-service domains to the agencies that actually run those services State for passports, the EAC for vote.gov.
Name a security contact
A real, reachable security contact for each domain. Passports.gov's field is currently blank.
We would revise substantially if a court held the Studio is presidential staff and the filings were never required, or if the certificate dates turn out to reflect something other than what we think they reflect.
Corrections are logged with a date and a description of what changed, and are never quietly edited. Send one to [email protected].