The surveillance technology the government uses to track you without a warrant doesn't come from a secret espionage app. It's embedded in the code of the mundane applications you've already installed — the weather app, the casual game you spent hours playing, even the daily prayer application. These apps request location access for basic functionality, but beyond that, an invisible tracking ecosystem collects, stores, and sells the location data of these devices, turning ordinary smartphones into constant trackers.
The company at the center of this ecosystem is Penlink, a US-based digital intelligence firm that operates a system called Webloc. What it does, in practice, is track hundreds of millions of mobile devices in real time, combining location data collected through advertising SDKs embedded in everyday apps, and selling access to law enforcement agencies around the world.
A $200 million acquisition
Penlink was founded in 1986 in Lincoln, Nebraska, and for decades provided traditional surveillance technology to the US government: call interception, internet data analysis captured during investigations. Its clients included the FBI, DEA, Secret Service, Marshals, and numerous state and municipal police departments.
In 2022, New York private equity firm Spire Capital acquired Penlink, and the following year made a deal worth approximately $200 million for Cobwebs, an Israeli startup that had developed Webloc technology for counterterrorism work. The merger of the two companies changed Penlink's profile: from traditional surveillance supplier to operator of a global tracking system based on digital advertising.
According to US government procurement documents, ICE (Immigration and Customs Enforcement) spent about $9 million between 2022 and 2026 on four contracts with Cobwebs and Penlink to license Webloc. ATF (Bureau of Alcohol, Tobacco, Firearms and Explosives) also piloted the system before cancelling the contract following pressure from lawmakers — ATF had purchased data that, according to Senator Ron Wyden, was obtained through "legally dubious and unlawful means."
How the invisible tracking works
Webloc works in a simple but powerful way. When you install a free app on your phone, it likely requests access to your location. The app might need this to tell you if it's going to rain tomorrow or find the nearest church. But what happens afterward has nothing to do with the app's original purpose.
Developers embed SDKs — software development kits — from advertising companies within their apps. These SDKs collect information about where your device is at any given moment, then pass that data to a broader ecosystem of real-time bidding auctions that feeds location data brokers.
Penlink accesses these brokers and builds a continuous location profile of each device, identified by a MAID (Mobile Advertising Identifier), the unique number the operating system assigns to your device for advertising purposes. Over the last 12 months, the system can reconstruct where you've been: home, work, meetings, temples, protests. In demonstrations, Penlink tracked people walking down Fifth Avenue in New York, approaching the European Central Bank in Frankfurt, and near the UK Parliament in London.
The data is massive. According to documents reviewed by Bloomberg News, Webloc provides access to a constantly updated stream of geolocation records from 500 million phones and other mobile devices worldwide.
The legal gray zone
The central controversy is legal. In 2018, the US Supreme Court ruled in Carpenter vs. United States that police need a warrant to access historical cell phone location records obtained directly from carriers. But federal courts have consistently argued that this principle does not apply to location data that agencies buy from commercial sources like Penlink.
This means police can buy location data without a warrant, without going through the judicial process that would be required if they wanted the same data directly from a carrier. As Bennett Cyphers, special advisor at the EFF, described it, it's "sort of a mass surveillance program on a budget."
Webloc prices start at around $100,000 per year, with costs rising depending on the number of users and the amount of data requested. But the system has also trickled down to smaller agencies: Citizen Lab, a research unit at the University of Toronto, identified state and municipal buyers in a report published in April 2026.
The global scale
Penlink operates not only in the US. According to sales records and people familiar with the business, the technology has been sold to the UK, Saudi Arabia, the United Arab Emirates, Singapore, and other countries. Each customer who licenses Penlink's main analysis suite, Tangles, can also acquire Webloc as an add-on.
The company's defense is strong. Sean White, partner at Spire Capital, claims Webloc was "materially changed" after acquiring Cobwebs. A Penlink spokesperson told Bloomberg Law the company "is proud of the long-standing relationship" with ATF and that the contract was cancelled because the system "does not meet our needs."
But the criticism is that the business model itself — extracting location data from digital advertising to sell to law enforcement — has existed for years and has been widely documented by digital rights organizations. In a March 2026 report, the EFF identified that SDKs from companies like InMobi, BidMachine, Verve, and Huawei's Petal Ads collect and share user location by default, without the app developer's knowledge or meaningful user consent.
What this means for you
The implication is straightforward: if you have a smartphone, your phone has likely already sent location data to a system that could be purchased by a law enforcement agency — and possibly by foreign governments. The technology doesn't discriminate between a criminal suspect and a journalist, an activist, or a regular commuter going to work.
Apple itself tried to curb this ecosystem in 2021 by forcing apps to request user MAID access. The result? 96% of US users opted out, effectively disabling advertising identifiers on most iOS devices. But the same doesn't happen on Android, where MAID tracking remains nearly uninterrupted, and many of the advertising SDKs listed by the EFF operate independently of user consent.
The question that remains is whether the American Convention on Human Rights and each country's constitution adequately protect freedom of assembly and movement against a system that maps these movements without warrants. If digital advertising tracking technology is as ubiquitous as advertising itself, and data protection legislation still hasn't consistently reached it, the near future may bring surprises far larger than half a billion phones mapping our steps to sell ads no one asked to receive.
Sources: Bloomberg, Electronic Frontier Foundation, LavX News
✓ Independent sources cross-checked and verified before publishing
