Ad-data tool Webloc tracks hundreds of millions of phones without warrants

Penlink, a Nebraska-based digital intelligence company, has sold a mobile tracking system called Webloc to law enforcement agencies in the United States, the United Kingdom, Saudi Arabia, the United Arab Emirates, Singapore, the Netherlands, Germany, Austria and Hungary, according to sales records and people familiar with the company's operations.

Webloc collects location data from smartphones via commonly used weather, gaming, email and religious apps. It can reconstruct where a device has been over the past 12 months, update that data hourly, and allows officers to query "billions of location data points" to identify every phone present at a specific place and time, according to company documents.

The technology was originally developed by Cobwebs, an Israeli startup founded in 2015 by three veterans of Israeli special forces. Spire Capital, a New York private equity firm, acquired Penlink in 2022 and then bought Cobwebs in 2023 in a deal worth about $200 million, merging the two companies. Licenses for Webloc start from around $100,000 per year.

In the United States, the Justice Department has argued that the Supreme Court's 2018 ruling — which requires a warrant to obtain location data from telecoms companies — does not apply to data purchased from commercial sources. Webloc users include US Immigration and Customs Enforcement, at least two branches of the US military, and more than a dozen American police forces.

Nathan Freed Wessler, deputy director of the American Civil Liberties Union's Speech, Privacy, and Technology Project, said the evidence showed a "ridiculous expansion of these tools" and raised "tremendous concerns" over the lack of legal oversight. He said "people are going to be investigated who the government has no business investigating."

A Penlink spokesperson said Webloc was provided only to clients in support of law enforcement and national safety efforts and that the company was "committed to complying with applicable laws and regulations."

In 2021, Meta Platforms banned roughly 200 accounts it accused Cobwebs of using to trick people into revealing personal information, citing targeting of activists and opposition politicians in Hong Kong and Mexico. Cobwebs subsequently ceased selling a product called Trapdoor and shifted focus to Webloc and a social-media surveillance product called Tangles.