The White House app climbed to No. 1 in the Apple App Store news category last week after Trump TV, its around-the-clock broadcast channel, was presented as a news source once networks stopped their pool coverage. The White House promoted the surge in a news release for the app that carries the stream, saying, “The American people are not waiting on those cameras; they are going straight to the Presidency.”
Getting that feed requires users to hand over data, cybersecurity researchers said, and those users may not know how the government could use it. According to The Washington Sun, Philip Fields, a cybersecurity researcher and former FBI intelligence analyst who has studied the app, said, “The people who do want to hear that message are going to the White House for it, and in doing so, they’re giving up a lot of information about themselves, and that provides the White House with an advantage going into the midterms.”
Researchers have speculated that information gathered through the app, including results from political polling it hosts, could be used to send campaign messages, send a user’s name to Immigration and Customs Enforcement or the Secret Service, or generate revenue. Reporting on the app said no one can state with certainty where that user data finally goes.
Experts said third-party trackers handle collection after the app left its privacy manifest empty
The Washington Sun said its own risk review, conducted with cybersecurity specialists, found that the app gathers more user data than it discloses, routes that data to external trackers, and does not comply with the federal security rules that apply to government apps. Joseph Gera, a former Apple App Store developer and senior platform engineer, said, “The bottom line is this app is just not very stable or secure.”
He also said, “It’s asking for your location data in real time. It also asks for personal information to access your financial data, to access your messages, to access all kinds of information.”
Government apps and sites are supposed to meet standards set by the National Institute of Standards and Technology and be cleared by security staff within each agency. The White House would not answer a series of questions about whether the app meets those risk-management rules and pointed instead to the same news release that touted the download numbers.
Analysts had already flagged the app earlier this year for sending IP addresses, time zones, and other details to outside firms that include Parsely, OneSignal, and Elfsight, a Russian widget service. Those findings, they said, leave both ordinary users and government employees exposed.
The app is still preloaded on official phones across the executive branch. After the Trump administration ordered agencies to force-install it on every government-issued mobile device, researchers said the public security authorization and privacy reviews required by federal law had not been finished.
Developers later shifted tracking work to commercial vendors after criticism of the app’s own security setup. Gera said the software still runs scripts that check a user’s location several times each minute. How the White House or the vendors use those pings has not been made clear. Fields said, “The way that they’re doing their collection now is harder to discern, because they’ve just used commercial trackers instead.”
Gera also said the app includes a latent keylogger script taken from the web and written by an amateur coder in India. The Sun said its review matched that finding. Keyloggers are often used in spyware to save what a person types, though they can also measure things such as how often someone types. Fields said the script is unlikely to function on phones, but still called it concerning that the White House relied on code pulled from a foreign amateur developer.
Files inside the app name 45Press, an Ohio firm that describes itself as a WordPress shop, as the developer. Public contracting records show the company received more than $1.4 million in February for White House online work. The firm does not answer press questions about its client contracts.
Apple and other stores require a privacy manifest that lists what an app collects. The latest White House build left that form blank, which would mean the app takes no user data. Specialists said that the blank form does not match what they found in the software.
Fields said most of the data is sent first to third-party vendors that may sell it to advertisers, foreign governments, or back to U.S. agencies. He noted that federal offices have already acknowledged buying Americans’ records from data brokers.
Fields said, “It could be bought and sold by government agencies at this point because they’ve decided that they’re not going to take the Carpenter ruling seriously.” He added, “And they can just go and get ad data for free from the private sector or buy it from them without legal process.”
In Carpenter v. United States, the Supreme Court held that agencies need a warrant to obtain cellphone location records. Agencies have argued that broker data is anonymous because it is tied to advertising IDs rather than names. Specialists have disputed that claim, saying home and work addresses and commute patterns can still link an ID to a real person, especially when artificial intelligence is applied.
The app’s privacy policy says collected data “is governed by the third-party website’s security and privacy policies.” The same policy says the information can be used to build tailored content and statistical profiles, to shape policy, or to share “information with other government agencies in response to lawful law enforcement requests.”
Reporting also described an unpublished tool in a White House browser extension that let administrators build a political profile of a user and offered an “investigate” button to send that person to the Secret Service.
The Center for American Progress said the Trump administration has worked to fold Americans’ sensitive records into shared federal databases. This concern about sensitive data sharing has played out in other contexts, such as when ICE was reportedly ordered to delete Medicaid data on millions of people but instead sent it to Palantir.
An August CAP analysis described taxpayer and Medicaid files being shared with ICE as part of a DOGE effort to merge agency data. The report said, “Centralized databases are also more vulnerable to security breaches and internal misuse.”
A 2015 breach at the Office of Personnel Management exposed security-clearance files for 21 million federal workers and contractors. Peter Loge, who was among those affected and now runs the Project on Ethics in Political Communication at George Washington University after serving as an Obama-era FDA adviser, argued the White House is more likely to use app data to steer supporters toward Trump merchandise or cryptocurrency products than to run a political targeting operation.
“What we’ve seen is that Donald Trump is a businessman who’s monetizing politics. Therefore, this app is a way to make money,” Loge said. “The other people who could find this information either directly or through several layers of resale are, of course, hostile governments – foreign actors whose interests are the demise of American democracy.”
Published: Sep 29, 2026 10:00 am