Login.gov adds persistent browser ID as government pushes universal federal sign-on

As the federal government moves to make Login.gov the common gateway to online public services, the identity platform has quietly begun assigning browsers a persistent identifier attached to analytics that include IP addresses, browser information, and other device data.

The Drey Dossier first reported the existence of the NDS experiment identifier, its apparent 20-year lifespan and its attachment to Login.gov analytics.

The identifier, called nds_experiment_uuid, is stored as a long-lived browser cookie and appears in Login.gov’s analytics code, along with data on a visitor’s device, operating system, browser, and referring webpage.

Login.gov introduced the identifier to determine which version of its redesigned interface a browser receives as part of an experiment with the National Design Studio (NDS), a White House organization created by executive order in August 2025 to improve the design and usability of federal digital and physical services.

A subsequent code change added the same identifier to Login.gov analytics events. Code being developed to let users opt out of Login.gov’s redesigned interface does not remove the identifier.

A Login.gov developer approved the implementation in code review on September 14, even though a separate GitHub issue questioning the identifier’s apparent 20-year lifespan and asking which privacy review covers it remained unanswered.

The developments raise questions about how the practice aligns with Login.gov’s public statement that its website analytics are anonymized.

The change comes as Login.gov is evolving well beyond its original role as a shared federal sign-in service.

The General Services Administration (GSA) now describes it as a “Government-wide Identity Platform.”

The Office of Management and Budget (OMB) directed agencies to offer Login.gov as a sign-on option for in-scope public-facing services that require authentication, subject to specified exceptions. Agencies may also offer other qualifying authentication systems.

For services that require identity verification, agencies generally must use Login.gov’s identity-verification capabilities unless the platform cannot meet requirements specific to the service’s users, risk profile, or operations.

Login.gov’s publicly available source code checks for the nds_experiment_uuid before processing Login.gov requests. If the cookie is not already present, the application generates a random UUID and stores it using a Ruby on Rails function that sets the cookie to expire 20 years in the future unless it is deleted or replaced.

The platform’s analytics code separately adds the identifier to analytics events.

Those records can also include the user’s IP address, the Login.gov hostname visited, the referring webpage, the user-agent string, browser name and version, operating system information, device name, and indicators showing whether the browser appears to be running on a mobile device or as a bot.

The code raises questions about how the new identifier fits with Login.gov’s published privacy representations.

Login.gov states in its Privacy Act statement that website analytics, including information on pages visited and session duration, are aggregated and anonymized, and that “no personally identifying user information is tied to this data.”

The same statement separately says that Login.gov analyzes devices, session metadata, and user behavior to mitigate fraud, and that device and behavioral information used for risk assessment is stored in an obfuscated form.

The newly added identifier appears in Login.gov’s general analytics code alongside IP addresses and detailed browser and device information.

The code does not establish that GSA considers the identifier itself personally identifiable information, nor does it show that the data identifies a particular person. However, a persistent identifier makes it technically possible to link repeated activity from the same browser over time until the identifier changes or is removed.

A GitHub issue opened September 12 sharpened the privacy questions. The issue notes that nds_experiment_uuid is created using a permanent cookie and asks whether the identifier’s apparent 20-year lifetime is intentional.

It also states that the cookie is created on certain public Login.gov endpoints and asks which privacy assessment covers the identifier, its database use and the analytics records it is attached to.

As of September 16, the issue remained open, and GSA had published no substantive response.

Meanwhile, a Login.gov developer approved the related pull request in code review without changing the persistent-identifier behavior questioned in the issue.

The identifier was introduced as part of work surrounding Login.gov’s new NDS user interface.

Developers are also creating a mechanism that lets users presented with the new design “Switch to legacy,” effectively opting out of the new interface.

But code associated with that function clears a separate ui_test_bucket cookie while maintaining an opt-out record associated with the NDS experiment. It does not remove nds_experiment_uuid, according to the September 12 GitHub issue.

A related Login.gov pull request says the opt-out mechanism is intended to let users switch away from the redesigned interface and record an analytics event when they do so.

On September 14, a Login.gov developer approved the proposed changes in code review, saying they “look fine.”

The pull request had not yet been merged, but the implementation under review still cleared the separate ui_test_bucket cookie while leaving nds_experiment_uuid in place.

That means the mechanism Login.gov is advancing would allow a visitor to opt out of the redesigned interface without removing the persistent browser identifier associated with the experiment.

The user’s opt-out decision would instead remain associated with that identifier.

That does not necessarily mean Login.gov users cannot remove the persistent identifier themselves.

Deleting browser cookies would ordinarily remove a cookie stored on the device. But the GitHub issue notes that manually deleting the identifier could also interfere with the mechanism that remembers whether a user opted out of the NDS experiment.

The coding changes come amid a much larger transformation of Login.gov.

An Office of Management and Budget memorandum issued August 31 says the administration is enforcing Login.gov as the “universal sign-on” for public services online.

OMB requires agencies to offer Login.gov as a sign-on option for in-scope public-facing websites that require authentication, subject to specified exceptions. Agencies may also offer qualifying alternative authentication systems.

For public-facing services that require identity verification, agencies must use Login.gov’s identity-verification service unless they determine that it cannot meet requirements specific to the service’s user base, risk profile, or operations.

GSA has gone further in describing where the platform is headed.

Login.gov planning documents describe a “Government-wide Identity Platform” that connects private-sector document authentication, biometric, and fraud-detection tools with authoritative government records involving Social Security numbers, driver’s licenses, passports, and addresses.

The same architecture shows current or planned capabilities for sharing user-attribute updates and fraud or threat signals with government agencies.

The architecture does not mean federal agencies automatically gain access to all information associated with a Login.gov user.

Login.gov says individual agencies receive information only under specified circumstances and that users generally must consent before sharing validated personal data with a participating agency.

The service also says it does not make eligibility or suitability determinations for federal programs. Fraud prevention, however, operates under broader rules.

The Login.gov privacy statement says it may share information with other federal agencies and third-party fraud-prevention services when needed to detect and investigate suspected fraud.

It also says Login.gov vendors can retain personal information for more than 90 days when needed to investigate or prevent suspected fraud.

Device identification is already part of Login.gov’s fraud controls.

A GSA privacy impact assessment has documented Login.gov’s use of several forms of device fingerprinting, including a Login.gov-generated device fingerprint and third-party JavaScript-generated device fingerprints.

GSA’s privacy documentation has also described collecting detailed device information for fraud analysis and behavioral information that can include keyboard, mouse, touchscreen behavior, and other device-sensor data.

GSA has since gone further. An August 24 Request for Information sought industry information about device intelligence and fingerprinting technology that can generate persistent device identifiers and recognize the same device across sessions.

Draft requirements called for technology that uses a broad range of browser, device, and network signals and can resist attempts to evade recognition through virtual private networks, incognito or private browsing, cleared cookies, and other techniques.

This article has been updated to credit The Drey Dossier for first reporting the persistent NDS browser identifier.

Article Topics

device fingerprinting  |  digital government  |  digital identity  |  Login.gov  |  single sign-on  |  U.S. Government