Who is following the trail your phone leaves through the web of advertising trackers? A new report from Citizen Lab says law enforcement agencies have been using an ad-driven geolocation system called Webloc to monitor hundreds of millions of devices worldwide — a claim that forces a straightforward but unsettling question: when advertising infrastructure meets policing, who sets the limits?
What Webloc is and who sells it
Webloc is described as an advertising-based global geolocation surveillance system. The tool was developed by the Israeli company Cobwebs Technologies. After a corporate reorganization, the product is now sold by Penlink, the successor to Cobwebs Technologies, following a merger between the two firms in July 2023.
Where and by whom it has been used
According to Citizen Lab, law enforcement use of Webloc extends beyond a single country. The system has been attributed to Hungarian domestic intelligence, the national police in El Salvador, and several U.S. law enforcement and police departments. The Citizen Lab report says Webloc was used to track roughly 500 million devices by leveraging advertising data.
Why this matters: perspectives and implications
- Technologists: The intersection of advertising ecosystems and geolocation tools means that data designed for commercial targeting can be repurposed for surveillance. That repurposing highlights technical questions about data provenance, aggregation, and the limits of de-identification when location streams are combined at scale.
- Policymakers and oversight bodies: The reported global reach of a tool sold commercially and used by multiple state agencies raises governance questions about procurement, cross-border access to data, and the adequacy of legal and procedural safeguards governing when and how location-derived advertising data can be used for policing purposes.
- Users and civil society: If ad ecosystems can feed geographic tracking at scale, people who expect location signals to serve commercial personalization instead of law-enforcement scrutiny may find themselves exposed. This reality prompts questions about notice, consent, and remedies for individuals whose location histories are queried.
- Adversaries and abuse scenarios: The availability of commercial tools that fuse ad-derived signals into location intelligence creates potential vectors for misuse — whether through mission creep inside agencies, unauthorized queries, or transfers of capability to actors with weaker oversight.
Conclusion
The Citizen Lab findings, as reported, sketch a world in which ad infrastructure and state surveillance intersect at scale. That convergence does not resolve itself through corporate rebranding or cross-border sales; it forces public choices about transparency, accountability, and the limits of acceptable use. If an advertising pipeline can be refitted into a global geolocation dragnet, who will define the guardrails — and how will the public know they are adequate?
https://thehackernews.com/2026/04/citizen-lab-law-enforcement-used-webloc.html
