Webloc surveillance flagged
Investigations claim Webloc — a product tied to Penlink/Cobwebs — is tracking more than 500 million devices in real time to support ad‑style surveillance. The reporting raises privacy and data‑broker questions about large-scale device tracking being repurposed for profiling and targeting. ( )
A phone app can send location pings into the advertising market, and investigators say Webloc turns that ad data into live device tracking at massive scale. (citizenlab.ca) Citizen Lab said on April 9, 2026 that Webloc monitors “hundreds of millions” of people, and outside reporting on ICE documents described a database updated daily with billions of location points from hundreds of millions of phones. (citizenlab.ca, 404media.co) Citizen Lab said Webloc was developed by Cobwebs Technologies and is now sold by Penlink after the companies combined in July 2023. Penlink’s own July 11, 2023 announcement said the deal would bring together social media, location data, financial records, license plate reader data, and phone records in one platform. (citizenlab.ca, penlink.com) The basic mechanism is simple: apps collect location data for advertising, brokers package it, and a surveillance tool lets a customer search where a device has been. Citizen Lab calls that “ad-based surveillance,” and 404 Media reported ICE materials said the data could be queried without a warrant. (citizenlab.ca, 404media.co) Citizen Lab said Hungarian domestic intelligence has used Webloc since at least 2022 and still uses it, and that customers also include El Salvador’s national police. The group also identified United States users including Immigration and Customs Enforcement, the United States military, the Texas Department of Public Safety, New York City district attorneys, and police departments in Los Angeles, Dallas, Baltimore, Tucson, Durham, Elk Grove, and Pinal County. (citizenlab.ca) 404 Media reported in January that ICE training material described using Tangles and Webloc to watch a neighborhood or city block, identify phones present there, and follow those devices from work to home. That reporting said the system was purchased during ICE’s deportation push and speech-monitoring crackdown. (404media.co) Citizen Lab said it sent 96 freedom of information requests and concluded that governments in Europe and the United Kingdom are highly nontransparent about possible use of ad-based surveillance tools. The report also said Cobwebs founder Omri Timianker has links to spyware vendor Quadream and now oversees Penlink’s international operations. (citizenlab.ca) Penlink has framed the combined platform as a tool for investigators and prosecutors, saying it helps agencies connect digital evidence across multiple data sources. Civil liberties critics have framed the same capability as a way to bypass normal court oversight by buying access to commercially harvested phone data. (penlink.com, 404media.co) That fight is already moving into oversight channels. On February 6, 2026, 404 Media reported that the Department of Homeland Security inspector general opened an audit into how the department collects, shares, and secures personally identifiable information and biometric data, including whether those programs led to violations of federal law and privacy rules. (404media.co) The central question is no longer whether ad-tech data can map a person’s life; investigators and agencies have already built products around that premise. The open question is how many governments bought in before the public knew the scale. (citizenlab.ca, 404media.co)
