Newsletters
Webloc, a surveillance tool developed by United States-based technology company Penlink, can track people’s movements using location data collected from popular smartphone apps.
According to company documents reviewed by Bloomberg, the system can monitor hundreds of millions of phones worldwide and record up to 70,000 locations a device has visited in the past 12 months.
Webloc gathers data through third-party tracking software embedded in weather, game, email and religious apps.
Added to apps to generate advertising revenue or use user data, the software follows phones through advertising IDs assigned to devices.
In addition to GPS data, the system sometimes draws on Wi-Fi signals and cell towers. Law enforcement can view phones present at a specific place and time on a map.
The data can be updated hourly, allowing phone movements to be followed in near real time.
In 2018, the U.S. Supreme Court ruled that law enforcement needs a warrant to obtain location data from telecommunications companies.
The Justice Department argues the requirement does not apply to data purchased from commercial sources.
Webloc’s U.S. users include Immigration and Customs Enforcement (ICE), at least two military units and dozens of police departments.
According to Bloomberg’s records, ICE spent about $9 million between 2022 and 2026 under contracts with Penlink and Cobwebs.
Authorities in the United Kingdom, Saudi Arabia, Singapore, Germany, the Netherlands and the United Arab Emirates also use the technology.
Nathan Freed Wessler of the American Civil Liberties Union said the expanding use of such tools raises serious privacy concerns.
Wessler said that because legal oversight is insufficient, people the government has no authority to investigate could also be put under surveillance.
Penlink was founded in Nebraska in 1986. Its clients include the FBI, the Drug Enforcement Administration and the U.S. Department of Homeland Security.
Cobwebs, the Israel-based company that developed Webloc, was founded in 2015 by former special forces members. Spire Capital acquired the two companies in 2022 and 2023.
Webloc has sold its technology to local police departments and federal agencies. According to a Citizen Lab report, police in Los Angeles, Dallas, Baltimore and Tucson have used the technology.
Tucson police said they used Webloc in burglary and robbery investigations and to identify suspects in the abduction of a university student. A police spokesperson said the department’s license has expired and was not renewed.
Documents reviewed by Bloomberg show Webloc collected location data from apps such as AccuWeather, Muslim Pro and Multi Maze 3D.
The owners of these apps said they have no commercial relationship with Penlink and do not provide user data to the company.
Penlink said it obtains data from its own data partners rather than directly from apps and that these partners collect data through agreements with app developers.
One data source is Israel-based Start.io. The company says it has embedded its software development kits in more than 500,000 apps and can reach 2.4 billion devices worldwide.
Penlink said it does not buy data directly from Start.io but that Cobwebs tested data from the source before the acquisition.
Digital rights experts note that users are often unaware their data can be used for surveillance. Although app terms of use include language on sharing data with third parties, the companies receiving the data are generally not disclosed.
Montana became the first state to ban law enforcement from buying location data from commercial companies without a court order.
Oregon, Maryland, New Jersey and Virginia have also restricted the sale of precise location data. Penlink said it has stopped collecting location data of people living in those states.
Penlink maintains that Webloc is offered only to support law enforcement and public safety activities.
The company said its data partners obtain user consent and remove sensitive locations such as hospitals, schools and houses of worship from datasets.
Experts say oversight of how public agencies use data collected by private companies remains inadequate.
Thorsten Wetzling of the Berlin-based think tank Interface said surveillance carried out jointly by the private sector and public institutions is growing more complex and harder to oversee.
Set as preferred source
Set as preferred source
7 min read
