Researcher reveals official White House app is one command away from tracking your precise location every 4.5 minutes – app can also inject code to dodge cookie consent, GDPR banners, and paywalls | Tech Radar
Overview
News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Details
Unlock and manage exclusive Techradar member rewards.
Unlock instant access to exclusive member features.
Get full access to premium articles, exclusive features and a growing list of member rewards.
Researcher reveals official White House app is one command away from tracking your precise location every 4.5 minutes – app can also inject code to dodge cookie consent, GDPR banners, and paywalls
An analysis of the app's APKs reveals some concerning features
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
An analysis of the official White House app has revealed some concerning features
The app is capable of blocking cookie consent options, GDPR banners, and paywalls
The app can track user's precise location every 4.5 minutes, and sends user data to non-governmental infrastructure
A security researcher has decompiled the new official White House app for Android that was released in March 2026, and has found some concerning features hidden inside.
Web developer Thereallo analyzed the app’s APK in a blog post and found it is capable of injecting code into third-party websites to hide cookie consent popups, GDPR banners, paywalls, and more.
It can also track your accurate GPS location every 4.5 minutes, pulls code from unsecured non-government infrastructure, and provides highly invasive profiling of every user.
FBI urges users not to download Chinese mobile apps over privacy risks
Workplace apps gathering far more personal data than we all think
The EU’s age verification app has a privacy problem — and it may be more than just a 'bug in an app'
When the White House released the new app, it said it “offers Americans a direct line to the White House,” but it looks more likely that the reverse is true.
Hidden inside the Web View used for opening external websites is a Java Script snippet that has the ability to hide some fairly vital information typically displayed when you visit a website.
Blocking these core website functions means that users subject to GDPR or state-level privacy laws cannot exercise their legal right to opt-out of tracking. Furthermore, by circumventing paywalls, the US government is providing users with the ability to access content that is typically protected with a paywall.
The Google Play Store listing states that the app can request approximate and precise location data, with Thereallo noting that the app requests location permission at runtime, and that the app contains an Expo plugin intended to strip location tracking. But the app instead relies on One Signal SDK’s location tracking code.
The app can therefore collect accurate location tracking information every 4.5 minutes when the app is active, and every 9.5 minutes when the app is running in the background. While this tracking isn’t active by default, the entire process can be activated with a single command.
As Thereallo notes, “the infrastructure is there, ready to go, and the JS API to enable it is referenced in the bundle.” So while the app may not necessarily be tracking you today, it has the potential to be activated at any point in the future.
The Trump administration is building a website to help Europeans evade content bans
A developer found a Claude Code plugin collecting extensive telemetry across projects
Russia's state-backed MAX app may know if you are using a VPN to bypass censorship
One Signal is also used to collect profiling data on every user. “Your location, your notification interactions, your in-app message clicks, your phone number if you provide it, your tags, your state changes. All going to One Signal's servers,” Thereallo notes.
Additionally, the app also relies on code from a random Git Hub account to embed You Tube videos. Thereallo points out that if this account is ever compromised, the perpetrator could “serve arbitrary HTML and Java Script to every user of this app.”
The app also loads third-party code without adequate security infrastructure, sends your data to non-governmental infrastructure, and has no certificate pinning.
“Is any of this illegal? Probably not. Is it what you'd expect from an official government app? Probably not either,” Thereallo concludes.
An app advertised as a one-stop-shop for news and media direct from the White House is instead functioning as a highly granular user profiling, tracking and marketing tool. It is important to note that Thereallo’s analysis was conducted immediately after the app’s release, and therefore features may have been modified, added or removed.
Tech Radar Pro reached out to the White House for comment, but did not immediately receive a response.
➡️ Read our full guide to the best identity theft protection
- Best overall: Aura
- Best for families: Identity Force
- Best for credit beginners: Experian Identity Works
Follow Tech Radar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
Benedict is a Senior Security Writer at Tech Radar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.
Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.
Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.
You must confirm your public display name before commenting
1re Markable says its new Paper Pure tablet will give you 'room to think like a human’
2 Need a Mother’s Day Gift fast? These 12 last-minute bargains at Amazon arrive before Sunday
3 The first hydraulic brake-less care is coming, but is it a good idea?
4 Experts warn Microsoft Phone Link tool exploited by 'unknown threat' to steal SMS and OTP info
5 Freshworks and Coinbase announces major layoffs - AI blamed
Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.
© Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.
Key Takeaways
- News, deals, reviews, guides and more on the newest computing gadgets
- Start exploring exclusive deals, expert advice and more
- Unlock and manage exclusive Techradar member rewards
- Unlock instant access to exclusive member features
- Get full access to premium articles, exclusive features and a growing list of member rewards
