Webloc: Can Police Track 500 Million Phones From Ad Data Without a Court Warrant?

A surveillance tool called Webloc lets police trace the locations of hundreds of millions of phones worldwide over 12 months — and the data is collected from advertising in weather, game and even prayer apps. What is striking, according to a post by the page Học lập trình cho người mới bắt đầu synthesizing internal documents, research by Citizen Lab (University of Toronto) and records obtained by Bloomberg News, is that police can buy access without a court search warrant. This article organizes the whole story: what Webloc is, the routes by which location data travels from your phone to a surveillance system, what the parties involved say, and how users can protect themselves.

Quick answers

• What Webloc is: a phone-location surveillance tool developed by Cobwebs Technologies (Israel, founded 2015) and now sold by Penlink (US); commercialized since 2020, with licenses starting at about US$100,000 per year. Per internal documents and Citizen Lab research, the tool can access location data from up to 500 million mobile devices worldwide, showing 12 months of location history updated hourly.
• How phones are tracked: Webloc identifies devices using the Advertising ID — a code that contains no name or phone number directly, so the ad industry calls it "anonymous data", but when one ID keeps appearing at the same address at night and an office each morning, inferring identity is no longer hard. The tool can draw a zone around a street or building, list phones that appeared there, cross-reference devices seen at two different locations, send alerts when a phone appears at a new location, and estimate home and work addresses from overnight and daytime patterns.
• Two routes by which location data leaks (per Citizen Lab, which could not determine with certainty which mechanism is currently in use): (1) third-party SDKs embedded in apps — when a user grants location permission to a weather app, the SDK inside can read and forward that data to the SDK provider (documents mention Start.io; the Webloc developer denies buying data from Start.io, and Start.io says its contracts permit advertising use only); (2) real-time ad auctions (the bidstream) — an ad-display request can contain the Advertising ID and location, and auction participants and data brokers can collect them without any direct contract with the app.
• Why no court warrant is needed: a legal gap in the US — the Carpenter v. United States ruling (2018) requires a warrant to obtain location history from mobile carriers, but the US Department of Justice argues the requirement does not apply the same way to location data bought on the commercial market. A June 2026 ruling found that obtaining location history from Google can count as a search, but did not directly address buying data from brokers; lawyers disagree on its impact.
• Who uses it: per public procurement records and internal documents — ICE (about US$9 million across four contracts in 2022–2026), at least two US military units, more than a dozen US police forces (Dallas, Baltimore, LAPD with 136 searches in 2022 and 1,319 in 2023), Hungary's domestic intelligence agency (since at least 2022), El Salvador's national police (since 2021); the ATF ran more than 340 warrantless searches, then cancelled its contract in June 2026. The developer states the tool is provided only to law enforcement, public safety agencies and a small number of authorized government contractors.
• How users can protect themselves: on iPhone, turn off Allow Apps to Request to Track (Settings → Privacy & Security → Tracking); on Android 12 and above, delete the advertising ID (Settings → Privacy → Ads → Delete advertising ID); review each app's location permission, grant "while using" only when needed, turn it off entirely for apps that do not need location, and remove unused free apps. But these steps do not fully solve the problem — Google's developer rules still allow some apps to use their own identifiers as replacements for the Advertising ID.

What is Webloc, and who is behind it?

Per the post, the seller of Webloc is Penlink, a US company specializing in software for police investigations, particularly phone and internet data analysis. The Webloc technology, however, originally came from Israel: the product was developed by Cobwebs Technologies, founded in 2015 by three former members of Israeli special forces, initially aimed at counter-terrorism.

In 2023, both companies came under the control of the same US investment fund, and the Webloc business was then moved to the US side. The tool has been commercialized since 2020, with licenses starting at about US$100,000 per year.

In 2025, a US company prepared presentations introducing Webloc to police forces in many countries. In demonstrations, company staff showed how Webloc tracked a person's phone as they walked along Fifth Avenue in New York, visited the European Central Bank in Frankfurt, or moved near the UK Parliament building in London. Bloomberg News obtained those presentations along with training materials and many related internal records.

Can Webloc know where a phone has been for 12 months?

In April 2026, researchers at Citizen Lab, University of Toronto, published research on Webloc's surveillance capabilities. Based on contracts, public procurement records and leaked documents, the research group said the tool could access data from up to 500 million mobile devices worldwide.

According to documents collected by Bloomberg, Webloc can display a phone's location history for the most recent 12 months, with data updated every hour. An old US contract even mentioned the ability to store data for three years.

How it is used, per the post, is quite simple:

• Police open a map and draw a zone around a street or building.
• They select the time period under investigation.
• Webloc lists the phones that appeared in that area.
• The tool can cross-reference devices that appeared at two different locations in the same time period.
• The system sends alerts when a phone appears at a new location.
• It can also identify where a person regularly spends the night and where they appear during the day.

The last capability is particularly important: knowing that a device regularly appears at one address at night and another during working hours lets police infer the device owner's home and workplace. A 2021 sales proposal for a Central American police force even described the goal quite plainly: identify the person behind the device, find their home and workplace, and dispatch police to meet the suspect.

How are phones tracked? The "anonymous" Advertising ID and its limits

To identify a phone, Webloc uses the Advertising ID — a code designed for advertising on Android and iPhone, letting apps recognize the same device across many apps to deliver relevant ads. On iPhone, apps must ask the user's permission before tracking covered by the App Tracking Transparency policy.

The advertising industry often calls the Advertising ID anonymous data because the code does not directly contain the owner's name or phone number. But the problem is: if one identifier keeps appearing at the same address at night, then at an office every morning, inferring the device user's identity is no longer very hard.

According to Webloc data published by researchers since 2021, one location record can contain:

Information group in the record	Details
Identity and connectivity	Advertising ID and IP address; name of the Wi-Fi network the phone is connected to
Location and time	Time recorded, with GPS coordinates or a location inferred from nearby Wi-Fi networks
Device	Brand, model and operating system; list of apps on the phone with the first and last time the system recorded each app
Inferences about the person	Estimated home address, workplace and frequently visited places; age, gender and classification labels such as parent, tourist or gamer

The Webloc developer says the current version stores only location tied to the device identifier, no longer containing age, gender or interest information. However, the research group says it has no independent way to verify that claim — an important caveat to keep when reading this story.

Two routes by which location data leaks out

According to Citizen Lab, location data can reach Webloc through two main mechanisms. However, the researchers could not determine with certainty which mechanism is currently in use.

1. Through SDKs embedded inside apps

When developing a free app, developers often integrate ready-made code from third-party companies to display ads or analyze user behavior. These code bundles are called SDKs (Software Development Kits). If a user grants location permission to a weather app, the SDK embedded inside the app can read that location data and forward it to the SDK provider.

One company mentioned in the documents is Start.io. According to records, its SDK appears in more than 500,000 apps, with more than 25 billion total downloads; Start.io claims the ability to reach 2.4 billion devices, including 300 million in the US. An Android app-checking platform for detecting trackers also found SDKs linked to Start.io in more than 4,400 apps. Documents and accounts from former employees indicate that some of the location data in Webloc originated from this system.

However, both sides have responses that must be recorded: the Webloc developer denies buying data from Start.io, saying the Israeli side only ever tested this data before the company was acquired. Start.io responded that its contracts permit data use for advertising purposes only, that most data is not highly precise, and that the published download figures are only theoretical.

2. Through online ad auctions (the bidstream)

This is the more complex mechanism and requires no SDK integration in the app. When an app needs to display an ad, it sends a request to the advertising system; advertisers join an automated auction lasting a tiny fraction of a second to win the right to display that ad. The request can contain the phone's Advertising ID and location information, and auction participants can access this data. The data stream flowing through such auctions is called the bidstream.

Data brokers can join this ecosystem to collect location information from apps they never signed a direct contract with. That is also why many app developers do not know where their users' location data ultimately goes.

Webloc says its partners collect data through separate SDK agreements with user consent, but the partners do not provide a complete list of the apps involved. One notable detail in the 2021 records: Webloc could record the names of Wi-Fi networks a phone connected to — information that cannot travel through ordinary ad auctions and must come from code executed inside the app, indicating that at least some earlier data was collected directly from apps.

Which apps appear in the documents — and what do they say?

The records mention several specific apps: AccuWeather (a weather app on Android and iOS), Muslim Pro (a prayer app with more than 100 million downloads on Google Play) and Multi Maze 3D (a phone game). All three deny having any data-sharing agreement with the Webloc seller. The documents show data related to these apps but do not prove exactly which party transferred data to the surveillance system. With such a complex chain of intermediaries, even app developers may not know where user data has gone.

The Muslim Pro case has additional context: the app faced a similar controversy in 2020, when journalists found it sent precise location data to a data broker; the company later confirmed to a US senator that it had sold location data from phones in the US to US military customers through defense contractors. Muslim Pro called the report inaccurate at the time and said it ended relations with data partners. In January 2025, hackers stole data from another location broker, Gravy Analytics, including a list of thousands of apps whose data appeared in the company's system — Muslim Pro was on that list too. The app continues to state that it does not allow partner ad networks to collect location data.

Why can police buy data without a court warrant?

The problem lies in a legal gap in the US. In 2018, the US Supreme Court ruled in Carpenter v. United States that police need a court warrant to obtain a person's location history from a mobile carrier in cases covered by the ruling. However, the US Department of Justice argues that this requirement does not apply the same way to location data bought on the commercial market. In other words: if police ask a carrier for location history, they need a warrant; but if they buy similar data from a data broker, that may not require a warrant under the current interpretation of the law.

In June 2026, a new court ruling further found that obtaining a person's location history from Google can count as a search, because users have a reasonable basis to expect phone location data to be kept private. However, the ruling did not directly address buying data from data brokers. Some privacy lawyers argue the new ruling puts this kind of data purchasing on weaker legal footing, while a former Department of Justice official argues the ruling does not change the legality of commercial data purchases.

Which agencies use Webloc?

According to public procurement records and internal documents, Webloc has been provided to many law enforcement and government agencies:

• The US Immigration and Customs Enforcement (ICE) spent about US$9 million on four contracts in 2022–2026, including Webloc licenses.
• At least two US military units.
• More than a dozen US police forces, including Dallas and Baltimore.
• The Los Angeles Police Department ran 136 searches in 2022 and 1,319 searches in 2023 on Webloc and a related tool called Tangles.
• Hungary's domestic intelligence agency, using it since at least 2022 — Citizen Lab views this as the first confirmed case in Europe of advertising-data-based tracking.
• El Salvador's national police, which bought Webloc plus two other tools through a distributor in Mexico and has used it since 2021.
• Sales records and industry accounts also indicate Webloc was provided to London's Metropolitan Police and agencies in Saudi Arabia, Singapore, Mexico, Israel, the United Arab Emirates, the Netherlands and Germany.

Two specific cases are detailed in the post. In Tucson, US, local police signed a Webloc contract using border-security funding originally meant for investigations into human trafficking for sexual purposes; in an internal report from September 2023, police described using Webloc to investigate a series of burglaries and break-ins, identifying a suspect's apartment and their partner. Tucson police said the tool's license has expired.

The other agency is the ATF, which investigates firearms and explosives in the US. According to two members of the US Congress, the agency ran more than 340 Webloc searches without a court warrant, more than 222 of them related to cases under investigation. In a suspected arson case at a defense contractor's facility, a prosecutor and a judge expressed concern about using advertising data this way; investigators then asked the court for permission to collect data from cell towers instead. After the two lawmakers began asking questions, the ATF cancelled the contract in June 2026, stating the tool did not meet the agency's needs.

Who else has the tool been used to track?

In training sessions, Webloc sales staff demonstrated using the tool to track participants in pro-Palestine protests, suspected Iranian spies, Serbian militia groups and members of motorcycle gangs such as the Hells Angels. According to the company, these examples came from client agencies' requests, and including a scenario in training does not mean the company endorses that use.

The developer states Webloc is provided only to law enforcement, public safety agencies and a small number of authorized government contractors. Investors behind the product say the tool has helped find missing children, bank robbery suspects and human trafficking networks. The company also states its data partners all have user-consent mechanisms and exclude locations such as hospitals, schools and religious facilities.

However, the post notes: this consent usually exists only in an app's terms of use. Users may be told the developer may share location data with third parties, but that does not mean they know the data goes on to be sold to police surveillance tools.

Efforts to control the data trade

• In January 2025, the US Federal Trade Commission (FTC) banned a data broker and its subsidiary from selling sensitive location data after the Gravy Analytics data leak. According to the FTC, the two companies had claimed to process more than 17 billion signals a day from about one billion mobile devices. The ban still has exceptions for national security and law enforcement purposes.
• Also in 2025, Montana became the first US state to ban its police from buying location data on the commercial market without a valid search warrant or court order.
• A federal bill to close this legal loophole passed the US House of Representatives in 2024 but was never brought to a vote in the Senate. A similar idea now appears in a new surveillance-reform bill, but it has not yet passed.

How can users protect themselves?

While the data collection cannot be stopped completely, users can significantly reduce the amount of location information shared:

On iPhone: open Settings → Privacy & Security → Tracking → turn off Allow Apps to Request to Track.

On Android 12 and above: open Settings → Privacy → Ads → select Delete advertising ID.

In addition: check each app's location permission; grant permission only while using the app when truly necessary; turn off location entirely for apps that do not need it; remove free apps no longer in use.

However, these measures cannot fully solve the problem. Per the post, Google's developer rules still allow some apps to use their own identifiers as replacements for the Advertising ID when the advertising ID is deleted.

A reflection on privacy worth considering

People used to think that not posting photos, not making personal information public, or not sharing location on social media was enough to protect their identity. But in reality, a phone continuously creates digital traces through apps, advertising, IP addresses, Wi-Fi and content delivery systems.

A single piece of data alone may not reveal identity. But combined over time, they can form a fairly detailed map of a person's life: where they live, where they work, which places they frequent and what schedule they move on. What is worrying is not only that one app knows your location, but that the data can keep passing through many intermediaries and end up in a surveillance system the user never knew existed. In the digital world, sometimes you do not need to make your identity public to be identified — the phone in your pocket only needs to leave enough traces.

Frequently asked questions

What is Webloc, and where does its location data come from?

Webloc is a phone-location surveillance tool developed by Cobwebs Technologies (Israel) and sold by Penlink (US), commercialized since 2020. Per Citizen Lab and internal documents, the data comes from the phone advertising ecosystem through two mechanisms: third-party SDKs embedded in apps (for example, a weather app granted location permission) and the real-time ad-auction data stream (bidstream) containing Advertising IDs and locations. Researchers could not determine with certainty which mechanism is currently in use.

Why is the Advertising ID called "anonymous" but can still expose identity?

The Advertising ID contains no name or phone number directly, so the ad industry calls it anonymous data. But when the same ID keeps appearing at one address at night and an office each morning, the system can infer the device owner's home and workplace. A location record can also contain the IP address, GPS coordinates, Wi-Fi network names, device information and the list of apps.

Is it legal for police to buy location data without a warrant?

This is a debated legal gap in the US. The Carpenter ruling (2018) requires a warrant to obtain location history from carriers, but the US Department of Justice argues the requirement does not apply the same way to data bought on the commercial market. A June 2026 ruling on Google location data did not directly address broker purchases; privacy lawyers and a former Justice Department official disagree on its impact. Montana (2025) became the first state to ban state police from buying commercial location data without a warrant.

Which apps were named, and how did they respond?

The records mention AccuWeather, Muslim Pro and Multi Maze 3D; all three deny any data-sharing agreement with the Webloc seller. The documents show data related to these apps but do not prove exactly which party transferred the data. The Webloc developer denies buying data from Start.io; Start.io says its contracts permit advertising use only.

What should users do to reduce location tracking through advertising?

On iPhone: Settings → Privacy & Security → Tracking → turn off Allow Apps to Request to Track. On Android 12 and above: Settings → Privacy → Ads → Delete advertising ID. Also: review each app's location permission, grant "while using" only when needed, turn it off entirely for apps that do not need location, and remove unused free apps. These steps reduce tracking significantly but not completely, as some apps can use their own identifiers instead of the Advertising ID.

Conclusion

The Webloc story reveals a chain few users fully imagine: a free weather app asking for location permission, an SDK or an ad auction lasting a fraction of a second, a data broker, and then a surveillance tool that can redraw 12 months of a phone's movements — all happening without the user's knowledge and, under the current interpretation of US law, without a court warrant. The parties involved each have their own denials and explanations, and many links in the chain have not been independently verified. But the practical message is clear: location privacy depends not only on what you make public, but on the permissions you have granted to apps and what happens to the data after it leaves your phone. Reviewing location permissions and the advertising identifier is a small task, but one of the few users can do themselves, today.

Source: a post by the page Học lập trình cho người mới bắt đầu on Facebook (12 November 2026), synthesizing internal documents, research by Citizen Lab (University of Toronto, April 2026) and records obtained by Bloomberg News. Figures, allegations and denials are as presented in the post; the parties involved — the Webloc developer, Start.io, AccuWeather, Muslim Pro and Multi Maze 3D — all have denials recorded in the post. Edited and structured by Wotech Electronics. Illustrations: images attached to the original post.