The White House Built a Surveillance App and Calls It a News Feed

The Trump administration launched an official White House app on March 27, 2026. They marketed it as a direct line to the President. Breaking news. Live streams. Policy updates. A way to text the President and send feedback.

That description makes it sound like a simple news app.

It is not a simple news app.

A security researcher decompiled the app within hours of its release. The code tells a story the marketing materials do not. The app contains a full GPS tracking pipeline built by OneSignal, a commercial third-party notification company. That pipeline is designed to poll your precise GPS coordinates every 4.5 minutes when the app is in the foreground. Every 9.5 minutes when you are not using it. Latitude. Longitude. Accuracy. Timestamp. Whether you were actively using the app or it was running in the background. All of it syncs to OneSignal’s commercial servers.

The app requests access to your precise location, your approximate location, and your background location. It requests fingerprint and biometric hardware access. It requests the ability to modify your stored files. It requests the ability to run at startup. It requests the ability to draw over other apps. It requests the ability to view your Wi-Fi connections.

For a news app.

Stop and think about that for a moment. You open this app to read a press release. The app has the infrastructure to record your GPS coordinates and send them to a commercial server every 4.5 minutes. You close the app. The pipeline keeps running. Every 9.5 minutes. The full tracking code is compiled into the app. The JavaScript API to activate it is referenced in the app’s code. The app requests location permissions from you at runtime. Your phone becomes a government-connected tracking device sitting in your pocket.

And here is the part that should alarm every American who cares about their constitutional rights.

When law enforcement wants to track your location, they need a warrant. The Supreme Court made that clear in Carpenter v. United States in 2018. The Court held that accessing seven days of historical cell-site location information constitutes a search under the Fourth Amendment. The government needs probable cause and a judicial warrant to get that data.

Downloading this app changes the equation entirely.

A strong legal argument holds that by installing this app and granting location permissions, you waive those warrant protections. You volunteer your location data directly to the government through a third-party commercial pipeline. The government does not need a warrant for data you hand over willingly. No probable cause needed. No judge involved. You granted permission the moment you tapped “Allow” on the location access prompt.

Your phone is tracking you all day, every day, and most people have no idea how deep it goes. I break it all down in Chapter 3 of my new book, PRIVACY IN AMERICA: What Every American Needs To Know.

This is the precise danger. The Carpenter decision protected Americans from government surveillance they did not consent to. This app asks you to consent. And the privacy policy never tells you what you are consenting to.

The Privacy Policy Tells You Everything You Need To Know

The White House privacy policy is posted at the government’s website. Read it yourself. I did.

The policy was last updated January 20, 2025. The app launched March 27, 2026. According to all sources, this is the privacy policy that applies to the app. It makes zero mention of the mobile app. Zero mention of GPS tracking. Zero mention of OneSignal. Zero mention of location data collection. Zero mention of biometric access. Zero mention of background data collection.

The policy was written for the White House government website. It covers website visits, email subscriptions, cookies, and social media pages. The app collects fundamentally different data through fundamentally different technology, and the policy says nothing about any of it.

Here is what the policy does say, and pay close attention to the language.

The policy states that the White House collects your IP address, your domain name, information about your computer or mobile setup, the pages you visit, referral traffic data, and the amount of data transmitted to your device. That covers website visits.

The policy states that information you choose to share with the White House “may be treated as public information.” Read that line again. Your information may be treated as public information. The White House reserves the right to publish compilations of messages and comments and provide them to national leaders, members of the press, or other individuals outside of the Federal Government.

The policy states that the White House may share your information with other government agencies in response to “lawful law enforcement requests” or to protect against “security threats.” The definition of “security threat” is theirs to make. No independent oversight governs that determination.

The policy states that under the Presidential Records Act, the White House retains your information until the end of the current administration. Then it transfers everything to the National Archives. NARA may eventually release that material to the public. Your data sits in government archives for years.

The policy states the White House may use your information “to detect, prevent, and respond to security issues and other harmful or unlawful activities.” Again, the White House defines what constitutes a security issue. The White House defines what constitutes harmful or unlawful activity.

Now combine that policy language with the app’s technical capabilities.

The app has the infrastructure to collect your precise GPS coordinates every few minutes. The privacy policy says the government treats your shared information as potentially public. The privacy policy says the government shares your information with other agencies for law enforcement and security purposes. The privacy policy says the government retains your data for years under the Presidential Records Act.

The privacy policy covers none of the app’s tracking capabilities. You get no disclosure. You get no informed consent. You get a generic website policy that was written before the app existed.

---

---

What The App Collects And Where The Information Goes

Let me detail the specific technology embedded in this app and what information it exposes.

The app is built with React Native and Expo, running on the Hermes JavaScript engine. The backend is WordPress. The app was built by an entity called “forty-five-press” according to the Expo configuration. That means a private company, not a government IT team, built this application.

The OneSignal SDK compiled into the app contains three Android location permission strings: ACCESS_FINE_LOCATION for precise GPS, ACCESS_COARSE_LOCATION for approximate location, and ACCESS_BACKGROUND_LOCATION for tracking you when the app is closed. The timing constants are hardcoded: 270,000 milliseconds (4.5 minutes) for foreground updates and 570,000 milliseconds (9.5 minutes) for background updates.

The tracking pipeline is designed to capture your latitude, your longitude, the accuracy of the reading, the timestamp, whether the app was in the foreground or background, and whether the location came from GPS or network triangulation. All of that data syncs to OneSignal’s commercial servers. Three gates control activation: a software flag that the app’s JavaScript layer toggles, the user granting Android location permissions, and the device having a location provider. The full pipeline is compiled into the app and ready to fire.

The JavaScript API to enable it is referenced in the app’s code. The app requests location permissions from users at runtime. The security researcher who decompiled the app confirmed that determining whether the JavaScript layer currently activates the tracking requires analysis of the compiled 5.5 MB Hermes bytecode bundle. What is confirmed is that the infrastructure is present, the activation API is referenced, and the app asks for your location.

OneSignal does not stop at location. The decompiled code reveals a full user profiling system. The SDK tags users for audience segmentation. It associates phone numbers with user profiles through an addSms function. It tracks cross-device identification through aliases. It logs every notification you receive, whether you opened it, and whether you dismissed it. It tracks your in-app message interactions. It monitors permission changes, subscription changes, and user state changes. All of that data flows to OneSignal’s servers.

An Exodus Privacy audit of the app identified three embedded trackers. One of them is Huawei Mobile Services Core. Huawei. The Chinese technology company the United States government sanctioned over national security concerns. The sitting President’s official app contains tracking infrastructure from a company his own administration restricted.

The app also includes a “Text the President” feature. The decompiled code contains the preset string “Greatest President Ever!” tied to this feature, which collects your name and phone number. Those go into the system.

The app contains an ICE tip line button that redirects to the Immigration and Customs Enforcement reporting page. The app essentially turns your phone into a portable immigration enforcement reporting terminal.

The app embeds YouTube videos using a library that loads its player code from a personal GitHub Pages site belonging to an individual developer. If that GitHub account gets compromised, an attacker serves arbitrary code to every user of the app. A government application loads executable code from a random individual’s personal web page.

The app also loads third-party JavaScript from Elfsight, a commercial widget company, for social media embeds. That code runs inside the app with no sandboxing. It sends email addresses to Mailchimp. It loads images from Uploadcare. None of these are government-controlled infrastructure.

And here is a detail that should concern every privacy advocate and digital rights lawyer in the country: the app injects JavaScript into every website you open through its built-in browser. That injected code hides cookie consent banners, GDPR consent dialogs, login walls, signup walls, and paywalls. An official United States government application systematically bypasses privacy consent mechanisms on third-party websites. It strips away the tools that websites use to comply with privacy laws.

The app has no certificate pinning. Standard Android trust management handles all connections. On any compromised network, including corporate proxies and public Wi-Fi, traffic between the app and its servers is vulnerable to interception.

The Terms of Service

The White House terms of use state that the Office of Presidential Correspondence may need to collect personal information to respond to your message. They state that the White House may share this information with other White House components or government agencies.

The terms contain a single sentence that matters more than any other: “Information You Give Us May be Shared with Other Government Agencies.”

That sentence, combined with the app’s data collection capabilities, means every piece of information the app gathers about you is potentially available to every federal agency. Your GPS coordinates. Your phone number. Your notification behavior. Your browsing patterns within the app. Your engagement with ICE tip line features. All of it potentially shareable across the federal government.

The terms also state that English is the official language of the United States under Executive Order 14224 and that the Office may not accommodate correspondence in other languages. That provision reveals the intended audience and the political framework governing this application.

The Missing Legal Framework

No federal privacy statute governs how a government app collects and uses location data from American citizens. That gap matters here. I discuss this lack of federal privacy laws throughout each chapter of my new book.

The White House, as a federal entity, operates outside the reach of state consumer privacy laws like the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Those laws give California residents the right to know what data is collected, the right to opt out of sharing, and the right to deletion. Those protections do not apply to the federal government.

Here is the exposure most people miss. The app routes your data through multiple commercial third-party companies. OneSignal. Mailchimp. Elfsight. Huawei Mobile Services. Those commercial entities ARE subject to state privacy laws, including CCPA. Your data leaves the government’s domain the moment it hits OneSignal’s servers. And you have no visibility into what OneSignal does with the precise GPS coordinates of millions of Americans who downloaded a government app expecting to read press releases.

No app-specific privacy policy exists. No data processing agreement between the White House and OneSignal has been made public. No independent oversight governs the flow of your location data from a government app to a commercial server and beyond.

Contrast all of this with the Obama administration which also had a White House mobile app. The privacy policy for that app stated explicitly: “The White House Mobile App does not collect geolocation information or use location services.”

That sentence existed because the prior administration understood that a government news app has no legitimate need for your GPS coordinates. The current app represents a complete departure from that standard. And the current privacy policy does not even acknowledge the departure.

What This Means And What You Should Do Right Now

The app presents itself as a free information tool. The cost is your privacy. The cost is your precise location, reported to a commercial third party at regular intervals, retained under the Presidential Records Act, and potentially shared across federal government agencies.

Every RSS feed on the internet delivers news updates with a single permission: network access. Every major news organization in America delivers breaking news alerts, live streams, and policy updates through apps that do not need your GPS coordinates every few minutes.

This app does something different. And the privacy policy does not tell you about it.

If you downloaded the White House app, open your phone settings and review the permissions you granted. Revoke location access immediately. Revoke biometric access. Consider deleting the app entirely.

If you have not downloaded it, do not.

You do not need an app to read White House press releases. You do not need to give the federal government your GPS coordinates to watch a presidential speech. You do not need a tracking device in your pocket to stay informed about policy decisions.

The information in this app is free. The surveillance is the price. And no misleading press release is worth that.

Mitch Jackson, Esq.

---

Your privacy is disappearing. My new book, Privacy In America, shows you how to take it back. For a limited time it’s just .99 on Kindle. This is the 409 page playbook every American needs right now. Grab your copy before you share one more detail with the government or private corporation you didn’t mean to give away. Also available in audio and paperback.