Privacy and Security Concerns in the White House App

The White House released an official app on March 27, 2026 for iOS and Android. Independent researchers examined the launch builds and documented hidden consent-banner code, bundled location capability, third-party JavaScript, and undeclared telemetry. Some findings were fixed or disputed after publication. The original audit still shows what version 47.0.4 sent, but it does not prove every current build behaves the same way.

This is not a privacy-respecting government app. It is a case study in how not to build one.

What the Decompilation Found

Security researcher Thereallo decompiled the Android APK. Atomic.computer performed an independent iOS analysis and follow-up network traffic capture. Their findings overlap and confirm each other.

The app is built on React Native with Expo. It pulls content from a WordPress REST API at whitehouse.gov. Five tabs: Home, News, Live, Social, Explore. Technically unremarkable, except for what ships alongside it.

Consent Stripping: The Government Overrides Your Privacy Choices

The original release (v47.0.0) injected JavaScript and CSS into every webpage opened through its built-in browser. The injection targeted and hid:

• Cookie consent banners
• GDPR consent dialogs
• OneTrust popups
• Privacy banners
• Login walls and signup walls
• Paywall elements
• CMP (Consent Management Platform) boxes

The code also forced body { overflow: auto !important } to re-enable scrolling on pages where consent dialogs lock scroll. A MutationObserver continuously removed any consent elements that loaded dynamically.

Browser extensions like uBlock Origin do similar things. The difference: you choose to install those. The White House app did it silently, on every page load, without disclosure. The executive branch shipped code that destroyed the legal compliance infrastructure of every website its users visited.

GPS Tracking: Dormant but Remotely Activatable

The app ships with 10 separate OneSignal frameworks totaling approximately 2.4 MB. This includes OneSignalLocation.framework (104 KB) with a complete location tracking pipeline: permission requests, interval constants, fused location capture, background scheduling, and sync to OneSignal's API.

Network traffic analysis confirmed GPS coordinates are not currently transmitted. But the SDK's open-source code (v5.5.0) reveals that OneSignal's server sends a location_shared boolean on every app launch. If the server sets it to true, GPS tracking activates. The code explicitly prioritizes the server-side parameter over any local setting.

The original release requested always-on background location. Version 47.0.4 changed the permission string to "This app does not use your location." The OneSignalLocation.framework with sendLocation and requestLocation is still compiled in. There is no map, no local news, no geofencing, no weather. Nothing in the app needs location data.

OneSignal's version 5.5.0 source allowed a server response to set the location-sharing flag. The March traffic capture found no GPS coordinates. The White House later told The Newsground that the app does not request or collect user location. A current independent audit would be needed to settle what later builds contain and transmit.

Six WebViews Loading Russian-Origin JavaScript

Version 47.0.4 loaded live JavaScript from Elfsight, a widget company founded in Tula, Russia that describes itself as based in Andorra. Six separate WebViews loaded platform.js from Elfsight's CDN.

Elfsight uses a two-stage loader. The initial script calls Elfsight's server with widget IDs and the current page URL. The server responds with widget configuration and an array of additional script URLs. The loader then creates <script> elements for each URL and injects them into the page. No Subresource Integrity (SRI) hashes verify the scripts.

Elfsight's server decides what code runs. If Elfsight's CDN or backend were compromised, or if the company were compelled to modify its response, arbitrary JavaScript would execute inside the official White House app across all six surfaces.

Elfsight's privacy policy states it collects IP addresses, sets tracking cookies (session tokens and click tracking stored up to a year), and communicates with four separate Elfsight servers.

A later White House statement said Elfsight no longer supplied the social feeds. According to that statement, one script remained for a tax calculator inside a sandboxed WebView. No published independent traffic capture has verified that revised setup, so the six-widget finding should not be presented as the confirmed current configuration.

The Privacy Manifest Is Provably False

The March build's bundled privacy manifest declared:

NSPrivacyCollectedDataTypes: []  (empty array)
NSPrivacyTracking: false

Only 23% of the app's network requests go to whitehouse.gov. The other 77% go to third parties: OneSignal, Elfsight, Mailchimp, Uploadcare, and others.

That disclosure did not match the captured traffic. OneSignal's privacy guidance tells developers to disclose identifiers and usage data. The current App Store listing now lists identifiers, usage data, and diagnostics as data that may be collected but not linked to identity.

No Security Hardening

The first audited build had no certificate pinning and loaded YouTube player code from a personal GitHub Pages account (lonelycpp.github.io). Version 47.0.4 changed that player URL to whitehouse.gov.

It sends email addresses to Mailchimp. It hosts images on Uploadcare. It has a hardcoded Truth Social embed. None of this infrastructure is government-controlled. Expo OTA components are present, but the supplied static analysis reports EXUpdatesEnabled: false and EXUpdatesCheckOnLaunch: NEVER. A native update reviewed through the App Store would first have to enable that pipeline before Expo could deliver later code changes.

Lower-Exposure Access Options

Do not install the White House app. Access whitehouse.gov directly through a browser with privacy extensions. If you already installed it:

• Delete the app
• Revoke any location permissions you may have granted
• Check your notification settings for lingering push tokens
• If you submitted a contact form or signed up for the newsletter, that data (email, phone) is with Mailchimp

If you need to follow government news, use an encrypted DNS setup and access the website through a privacy-respecting VPN or Tails. Government apps are never the safe choice.

Sources

• White House: Official app launch announcement
• Apple App Store: Current listing and privacy disclosure
• Atomic Computer: Static analysis of the iOS app
• Atomic Computer: Network traffic analysis of version 47.0.4
• Thereallo: Decompiling the White House App
• The Newsground: White House and Elfsight responses
• OneSignal: Apple app privacy requirements