Seven federal systems, and what the record shows for each.

A working preview of vote.gov was built inside the Studio's staging environment, registered to the Executive Office of the President. The live vote.gov belongs to the Election Assistance Commission, which Congress made an independent bipartisan body after the 2000 Florida recount for exactly this reason: a sitting president is not supposed to control the place where citizens register to vote.

The certificate was logged April 10, 2026 ten days after Executive Order 14399 set a June 29 deadline for DHS to stand up citizenship-list infrastructure. A voter-facing federal site existed on White House infrastructure while the statutory owner of vote.gov was, on its own account, still only in discussions about modernization.

Passports are issued by the State Department. The registry puts this domain under the White House instead. What loads today is a sign-in wall: enter an email, receive a six-digit code. There is no State Department seal, no agency name, and no privacy notice. The security contact field in the .gov registry is blank.

Two photo upload subdomains appeared within a single hour on May 26, 2026. A passport photo is biometric data. Collecting it through a White House-controlled domain, with no published privacy filing and no named security contact, is the specific thing we think warrants an answer.

The federal government's shared sign-in service. More than 150 million people have accounts, and it performs biometric identity verification. Greg Hogan, formerly Chief Information Officer at OPM, now runs it. When a federal court enjoined DOGE personnel from OPM personnel records, three people were granted exceptions and Hogan was one of them.

We are marking this Watch rather than something stronger because we have not documented any change to how Login.gov handles data. The concern here is about who holds the access, not about a change we can point to.

A federal drug pricing site documented running PostHog session recording. Session recording captures far more than page views: mouse movement, clicks, scrolling, and form interaction, reconstructed as a replayable session. IP addresses were not stripped. The deployment used a reverse-proxy configuration routing analytics through a first-party path, which has the effect of bypassing ad and tracker blockers.

The tracking was apparently removed in June 2026, after the Guardian sent the White House detailed questions about the Studio's operations on June 4. Checking the site today may show nothing. The finding is what was documented before that date, and the removal itself.

We found no System of Records Notice in the Federal Register and no published Privacy Impact Assessment for this system. Whether either was legally required depends on an unresolved question we set out on the Evidence page. What is not in dispute is that neither exists.

Executive Order 14399 directs DHS and SSA to compile Confirmed Citizen Lists, with a June 29, 2026 infrastructure deadline. SAVE was designed to let agencies check immigration status for benefits eligibility; repurposing it as a voter-roll filter is a different use of the same data. The accuracy concern was borne out of the expanded system screened more than 67 million registered voters and flagged thousands as potential noncitizens, many of whom turned out to be citizens eligible to vote.

Certificate logs show roughly 40 Studio subdomains that were never announced, including staging previews for State Department, NASA, and DHS properties. All trace back to the Executive Office of the President and sit behind the same private Cloudflare account.

One deserves separate attention: fbi-kirk-tipline.previews.ndstudio.gov. A tipline is a system that collects reports from members of the public about other people. If the White House design office is building a tipline environment carrying the FBI's name, the questions are who requested it, what it collects, who receives the submissions, and whether the FBI knows.

A custom JavaScript file of roughly 540 lines, served from Studio infrastructure and deployed across Studio-run federal sites. It generates persistent session identifiers and posts telemetry to a Studio-controlled analytics endpoint. Unlike PostHog, this is not a commercial product with published documentation. It was written for these sites, and nothing describes what it collects or where the data goes.

This is the piece of the story a reader can least easily check for themselves, and the piece we would most like technical information about. The script is publicly served, so anyone with a browser can read it.