Police agencies in several countries can buy a commercial system that reconstructs the movements of hundreds of millions of mobile phones by mining location signals embedded in apps and advertising, according to company documents and independent research. The tool, called Webloc, is sold by the U.S. digital intelligence firm Penlink and was originally built by the Israeli startup Cobwebs. In the United States, it can reportedly be used without a court order.
- Key Point: Webloc draws on location data generated by weather, gaming, email and religious apps to place phones on a map.
- Key Point: A Toronto-based research center says the system can cover up to 500 million devices with three years of history, a larger figure than earlier reporting.
- Key Point: Confirmed users include U.S. Immigration and Customs Enforcement, the U.S. military, Texas public safety authorities, New York prosecutors and police departments in Los Angeles, Dallas, Baltimore, Tucson and Durham.
- Key Point: Outside the United States, Hungary’s domestic intelligence service has used the tool since at least 2022 and El Salvador’s national civil police bought it in 2021.
Sales pitches that follow people through capital cities
Penlink’s own marketing material for foreign police agencies last year showed the system trailing individuals along New York’s Fifth Avenue, past the European Central Bank in Frankfurt and near the British Parliament in London. The demonstrations suggest a product pitched as a routine investigative aid rather than a niche surveillance capability.
Operationally, an officer can pull up a phone’s past whereabouts across the previous 12 months, refreshed on an hourly basis. Investigators can also drop a pin on a location and retrieve every device that was present at a given moment. Company paperwork refers to billions of location records.
The Citizen Lab, a research center at the University of Toronto that studies technology and human rights, published an analysis of Penlink documents in April. Its figures exceed those in earlier press accounts, citing as many as 500 million devices and a history stretching back three years.
A customer list spanning agencies and continents
According to the Citizen Lab’s findings, U.S. buyers include Immigration and Customs Enforcement, the armed forces, the Texas Department of Public Safety and prosecutors in New York. Police forces in Los Angeles, Dallas, Baltimore, Tucson and Durham also appear, along with smaller counties and municipalities.
In Europe, the researchers describe the Hungarian case as the first confirmed instance of this kind of advertising-based surveillance on the continent. In the United Kingdom, the Citizen Lab filed freedom-of-information requests with 44 police bodies. Five said they did not hold the tool, while 39 declined to confirm or deny using it. Penlink is listed on the British government’s digital marketplace as an approved supplier for public contracts.
Legal boundaries remain unsettled. In 2018, the U.S. Supreme Court ruled that police need a warrant to obtain a phone’s location history from a carrier. The justices did not explicitly decide whether that requirement extends to the purchase of commercial data from brokers. The court has still not resolved whether law enforcement may buy a phone’s whereabouts from data intermediaries without going before a judge.
Political pressure and a canceled pilot
Lawmakers have begun to push back. In March, 72 members of Congress asked for an investigation into warrantless location-data purchases by ICE and other agencies. In June, the Bureau of Alcohol, Tobacco, Firearms and Explosives canceled its Webloc contract, which the agency characterized as a pilot program.
The ATF said it acted after Republican Representative Michael Cloud and Democratic Senator Ron Wyden raised objections, and a prosecutor and a judge had also questioned the tool’s legality in criminal cases.
A Penlink spokesperson told 404 Media that its tools rely on publicly or commercially available data to “advance criminal investigations and save lives.”
The Citizen Lab counters that such information can expose a person’s home address, religion or health status. That argument cuts to the core of the dispute: data that individuals surrender to a weather app or a mobile game can end up describing their most sensitive routines once aggregated at scale.
For technology companies, the case highlights how the advertising supply chain doubles as a location database that governments can license rather than subpoena. The next test will come from courts and legislators, who must decide whether buying commercial data is a legitimate shortcut around warrant requirements or a loophole that turns everyday apps into surveillance infrastructure.