The National Design Studio, a small White House office led by Airbnb co founder Joe Gebbia and staffed largely by veterans of Elon Musk's cost cutting team, ran commercial trackers on four public sites and posted none of the privacy filings the Privacy Act and E Government Act…
Imagine you need to renew a passport, check whether you can register to vote, or look up whether a prescription drug has come down in price under the new federal program. In recent months, a growing share of those searches has been routed not through the agencies Congress set up to run them, but through websites built by a small White House office called the National Design Studio, staffed largely by veterans of Elon Musk's Department of Government Efficiency, or DOGE, and led by Airbnb co-founder Joe Gebbia.
The studio was created by a Trump executive order in August 2025 "to improve our nation through better design." It now operates four public-facing sites covering areas including passport and voter information, prescription drug pricing, and the Trump Accounts children's savings program. According to the Guardian, all four sites ran commercial visitor-tracking software configured to evade the privacy tools many users install, and none of them appear to have carried the public privacy filings federal law generally requires of systems that collect personal information about the public.
That legal floor has two main planks, and both predate the modern web. The Privacy Act of 1974 generally requires federal agencies to publish a notice in the Federal Register describing any new system of records that collects personal information about the public. The E-Government Act of 2002 generally requires a privacy impact assessment before an agency launches a new information system that handles personally identifiable information. The four sites the Guardian identified do not appear to have done either, according to the paper; the specific filings the studio would have been expected to make should be confirmed at the fact-check stage.
The reporting has a second, more political lineage. Many of the National Design Studio's staff came out of DOGE, the cost-cutting unit Musk previously ran at the White House, Wired previously reported. That personnel flow matters because DOGE's relationship with existing privacy and procurement law was already a flashpoint in 2025: critics argued its contractors were never put through the same vetting as federal employees, and its spending was hard to trace. The new studio appears to have inherited at least some of those habits.
The structural problem is not the trackers themselves, which are common on commercial sites. It is the architecture around them. The studio sits inside the Executive Office of the President, not inside the State Department, the Department of Health and Human Services, or the Treasury, the agencies Congress typically designates to run passports, drug pricing, and children's savings. Its spending does not appear in USAspending, the federal contracting database the public and oversight agencies use to follow the money. And the third-party tools embedded on its pages send data to destinations the Guardian could not always identify, in part because the trackers were configured to evade the privacy extensions browsers offer ordinary users.
Critics quoted in the Guardian's reporting did not soften their concerns. "It's dangerous and it's going to erode trust," one privacy researcher told the paper, summarizing a worry that Americans will quietly stop using federal services for sensitive tasks if they cannot tell who is watching. The Drey Dossier, an independent investigative outlet on YouTube, had previously flagged similar problems with the studio's sites; the Guardian's reporting advances and corroborates that earlier work.
None of those critics are speaking for the National Design Studio or for Gebbia. The Guardian's account does not include a published response from either, and the studio's own site is one of the four under scrutiny, which makes it a difficult place to look for a defense. That absence is itself part of the story. If a White House office wants to operate federal-style services for the public, the burden is on it to show that the legal scaffolding built around federal data collection in the 1970s and after 9/11 applies to it. So far, that scaffolding is missing.
The next pressure points are concrete and named. Congressional committees with jurisdiction over the Executive Office of the President can ask whether the studio's spending should be in USAspending and whether its data flows should be disclosed. Inspectors general at the agencies whose missions the studio is now shadowing can ask whether the work belongs inside their own shops at all. The Office of Science and Technology Policy, which coordinates federal privacy policy, and the Federal Trade Commission, which polices unfair or deceptive data practices, both have tools that could be brought to bear. What is missing, for now, is not a legal theory but a venue.