The National Design Studio (NDS) ...... is led by Trump-aligned Airbnb co-founder Joe Gebbia and staffed by Doge veterans. At least two other figures with Doge backgrounds work alongside him. Greg Hogan moved to the studio and, according to Drey Dossier reporting, was put in charge of Login.gov. Akash Bobba, one of Musk’s original six Doge engineers, also apparently moved to the studio...as the security contact for the United States African Development Foundation, an agency unrelated to the studio’s stated mandate. While there is very little transparency about NDS staffing, several photos and one video on the NDS website appear to depict as an employee Edward “Big Balls” Coristine, an early Doge employee who allegedly exposed the social security data of hundreds of millions of Americans
A Guardian investigation found the office has been developing or redeveloping sensitive federal websites...the NDS built and now operates four public federal websites: ndstudio.gov, trumprx.gov, realfood.gov and trumpaccounts.gov. All four ran commercial visitor-tracking software...are configured to evade the privacy tools many web users install, and none carry the public filings federal privacy law requires under laws including the Privacy Act of 1974 and the E-Government Act of 2002A. The one published privacy instrument that relates to any of the four programmes, a treasury notice for the Trump Accounts programme, describes how the children’s-investment programme is administered but does not name PostHog and does not describe the tracking on trumpaccounts.gov at all.nalysis of the underlying source code for four of the websites found that on at least two of them, the studio installed a commercial tool called PostHog that closely tracks what every visitor does on the site. Another tool, apparently made in-house, sends user data to a destination that is not visible on the public internet. The NDS apparently removed this tracking software after the Guardian reached out to the White House.
The NDS has also built and runs White House-controlled versions of services the US Congress assigned to other federal agencies, including a passport-application portal that bypasses the state department’s existing site, and a copy of voter-registration site vote.gov, the federal voter-registration site that by law belongs to an independent bipartisan commission inside a website site only accessible with a White House login. A federal voter-registration system run from inside the White House, with identity and citizenship checks routed through systems the administration controls, could let an incumbent see who is registering, or check their registration, in the weeks before an election.
Donald Trump created the NDS by executive order on 21 August 2025, ostensibly to overhaul federal websites and digital services. The office sits within the executive office of the president as a “temporary organization”, a designation that places it outside the Senate confirmation process, outside the financial disclosure system applied to most federal appointees and outside the inspector general’s jurisdiction, which covers cabinet departments. The studio is staffed under the same hiring authority that ran Doge. Combined, the sites route sensitive interactions Americans have with their government through infrastructure the White House apparently controls. None of the NDS’s spending or its arrangements with outside vendors appears in USAspending, the federal contracting database, raising questions about how it is funded and overseen. Public ownership records maintained by the Cybersecurity and Infrastructure Security Agency (Cisa) list the executive office of the president as the registrant of the studio’s sites, including passports.gov and the vote.gov copy, meaning that the office controls the domains. There is no public record of how the studio pays its developers, PostHog or any of the other commercial services its sites use. The hiring authority the studio operates under keeps its staff roster off the financial-disclosure system that covers most federal appointees, and the executive office of the president, which houses it, has no inspector general.
Website source code shows that PostHog has been configured on NDS-run sites to route analytics requests through an address on the federal website itself, rather than through PostHog’s own servers. Because the request appears to go to the site the user is already visiting, rather than to a recognisable third-party address, adblockers don’t flag it. PostHog comes with a separate feature called session recording. Princeton University researchers who first documented the technology in 2017 wrote that watching such a recording was “as if someone is looking over your shoulder”.
On the Trump Accounts and TrumpRX websites, the feature has been built into the page code and is held inactive only by a single setting inside PostHog’s dashboard. The NDS can turn it on at any time, on either site, without making changes in the underlying website code. Separately, until the Guardian sought comment on this reporting, the NDS’s own website, ndstudio.gov, ran a 539-line piece of bespoke code that recorded visitors’ clicks, form entries and navigation; assigned each visitor a session identifier; and forwarded the captured data to an address that does not appear anywhere on the public internet. The script’s source code refers to it as AutoMonitor.
None of the four sites carry a privacy impact assessment naming PostHog or describing the IP addresses and on-site activity the tool collects.