Every App on Your Phone Is a Tracking Device

TL;DR

Citizen Lab published research on April 11 revealing that Webloc, an advertising-based geolocation surveillance platform, provides law enforcement and intelligence agencies with access to a continuously updated stream of records from up to 500 million mobile devices globally. The data includes device identifiers, GPS coordinates, and profile information harvested from mobile apps and the digital advertising ecosystem. Webloc is sold as an add-on to the Tangles social media intelligence system by Penlink, which acquired it from Cobwebs Technologies in 2023. U.S. customers range from federal agencies like ICE and the military down to county sheriff departments. The system enables warrantless continuous monitoring of location histories going back up to three years.

The takeaway

Citizen Lab researchers describe it as "intrusive and legally questionable."

500M

Devices tracked globally

3 yrs

Location history depth

ICE, DOD

Federal customers confirmed

Warrants required

WHAT CITIZEN LAB FOUND

Citizen Lab, the University of Toronto research group known for exposing Pegasus spyware and other surveillance technologies, published a detailed investigation into Webloc on April 11. The research team, led by Wolfie Christl, Astrid Perry, Luis Fernando Garcia, Siena Anstis, and Ron Deibert, mapped the system's capabilities, its corporate lineage, and its customer base across multiple countries.

Webloc was originally developed by Cobwebs Technologies, an Israeli intelligence company, and announced publicly in October 2020 as a "cutting-edge location intelligence platform." When Cobwebs merged with U.S. company Penlink in July 2023, the technology transferred. Penlink, founded in 1986, sells "mission-critical communications and digital evidence collection and analysis software" to law enforcement agencies worldwide. Webloc is now sold as an add-on to Penlink's Tangles platform, which provides social media and web intelligence capabilities.

The system works by purchasing data from the mobile advertising ecosystem. Every time an app on your phone displays an ad, a real-time bidding process occurs. That bidding process broadcasts your device identifier, GPS coordinates, IP address, and app usage data to dozens of advertising networks and data brokers simultaneously. Webloc aggregates this data at scale, creating a continuously updated surveillance feed covering up to 500 million devices. Customers can query location histories going back three years and infer identities from movement patterns.

WHO IS USING IT

The customer list reads like a cross-section of American law enforcement at every level. Federal customers include Immigration and Customs Enforcement (ICE) and U.S. military units. At the state level, the Texas Department of Public Safety and DHS West Virginia are confirmed users. City and county customers include the New York City district attorney's office and police departments in Los Angeles, Dallas, Baltimore, Tucson, and Durham. Even smaller jurisdictions like the City of Elk Grove and Pinal County have access.

Outside the United States, Citizen Lab attributed Webloc usage to Hungarian domestic intelligence and El Salvador's national police. The research also documented corporate ties between Cobwebs/Penlink and Quadream, another Israeli surveillance company known for developing iPhone exploits comparable to NSO Group's Pegasus.

The scale of adoption is the story. This is not a niche capability limited to federal intelligence agencies with classified budgets. It is available to county sheriffs and city police departments. The barrier between "mass surveillance infrastructure" and "local law enforcement tool" has been erased. Any department that can afford a Penlink subscription can query the location history of 500 million devices without judicial oversight.

HOW THE DATA PIPELINE WORKS

Figure 01

01

App usage. A user opens any ad-supported mobile app. Weather, games, news, navigation, fitness trackers. The app triggers an ad request.
02

Real-time bidding. The ad request broadcasts the device's advertising ID (MAID), GPS coordinates, IP address, device type, and app context to advertising exchanges and data brokers. This happens in milliseconds, hundreds of times per day.
03

Data aggregation. Webloc purchases this bidstream data at scale. It ingests device identifiers, coordinates, timestamps, and associated profile data from the advertising ecosystem into a searchable database covering 500 million devices.
04

Location intelligence. Law enforcement customers query the database by location, device ID, time range, or movement pattern. They can reconstruct where a device has been over the past three years, who it was near, and where it goes regularly.
05

Identity inference. By correlating device movements with known locations (home address, workplace, school, place of worship), analysts infer the real-world identity behind the advertising ID. No warrant. No subpoena. No notification to the target.

THE ADVERTISING DATA SURVEILLANCE PATTERN

This is the second time in two weeks the Atarus blog has documented how the advertising and data collection infrastructure people interact with daily is being weaponized for surveillance without their knowledge or consent.

On April 5, we published our analysis of LinkedIn's BrowserGate scandal, where hidden JavaScript on LinkedIn scans visitors' browsers for 6,000+ extensions covering religion, politics, health conditions, and job search activity, all tied to the user's real name and employer. No consent dialog. Not disclosed in the privacy policy.

Webloc operates on the same principle at a vastly larger scale. LinkedIn harvests browser data through its own website. Webloc harvests location data through the entire mobile advertising ecosystem. In both cases, the data subject has no visibility into what is being collected, no ability to opt out in any meaningful way, and no notification that their data is being used for purposes far beyond what they consented to when they installed a weather app or opened a social network.

The difference is that LinkedIn uses the data for its own commercial purposes. Webloc sells it to governments for surveillance. The data pipeline is the same. The customer changed.

CONFIRMED CUSTOMERS

WEBLOC CUSTOMER BASE (CITIZEN LAB)

Federal (US) //

ICE, U.S. military units
State (US) //

Texas DPS, DHS West Virginia
City/County (US) //

NYC DA, LAPD, Dallas PD, Baltimore PD, Tucson PD, Durham PD, Elk Grove, Pinal County
International //

Hungarian domestic intelligence, El Salvador national police
Vendor //

Penlink (acquired from Cobwebs Technologies, July 2023)
Platform //

Sold as add-on to Tangles social media intelligence system
Corporate ties //

Cobwebs/Penlink linked to Quadream (Israeli spyware vendor)

WHY THIS MATTERS FOR ORGANIZATIONS

1
Every employee's phone is broadcasting location data through the advertising ecosystem hundreds of times per day. If your workforce visits sensitive facilities, government buildings, client sites, or classified locations, their movements are being recorded in a commercial database that law enforcement and intelligence agencies can query without a warrant.
2
Disable advertising IDs on all corporate-managed devices. On iOS, go to Settings, Privacy, Tracking, and disable "Allow Apps to Request to Track." On Android, go to Settings, Privacy, Ads, and delete or reset the advertising ID. This does not eliminate data collection entirely, but it removes the persistent identifier that makes long-term tracking trivial.
3
Audit what apps are installed on devices that access sensitive environments. Any ad-supported app is a potential data source for platforms like Webloc. Free weather apps, game apps, and news apps that display ads are all broadcasting location data into the advertising bidstream.
4
For organizations operating in sectors targeted by nation-state actors, understand that advertising data surveillance is not limited to U.S. law enforcement. If Penlink's customer list includes Hungarian intelligence and Salvadoran police, the same data is almost certainly available to other intelligence services through other commercial vendors operating in the same advertising data market.
5
Include mobile device advertising exposure in your threat model. If you are a water district, energy utility, or government facility that we covered in the Iran PLC advisory two days ago, your staff's phones are generating location data that can identify who works at your facility, what shifts they work, where they live, and what patterns they follow. That is reconnaissance data delivered through the advertising ecosystem.

ATARUS ASSESSMENT

The advertising ecosystem has become the world's largest surveillance infrastructure, and it happened in plain sight. Every ad-supported app on every phone in every pocket is generating a data stream that commercial vendors package and sell to government agencies for warrantless location tracking of 500 million devices. Citizen Lab's research confirms what privacy researchers have warned about for years: the distinction between "commercial data collection" and "government surveillance" is a legal fiction. The data is the same. The collection happens through the same infrastructure. The only variable is who writes the check. For organizations that operate critical infrastructure, handle sensitive information, or employ people who access classified or protected facilities, advertising data exposure is not a privacy nuisance. It is an operational security gap that adversaries of all types, from local law enforcement to foreign intelligence services, can exploit using commercially available tools that require nothing more than a subscription.