Citizen Lab: Webloc Tracked 500M Devices Via Ad Data
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Citizen Lab researchers attributed use of Webloc to Hungarian domestic intelligence, El Salvador's national police, ICE, the U.S. military, and police departments in Los Angeles, Dallas, Baltimore, Tucson, Durham, and other cities
- Webloc, developed by Israeli firm Cobwebs Technologies and now sold by Penlink after their July 2023 merger, pulls device identifiers, location coordinates, and profile data from mobile apps and digital advertising across up to 500 million devices
- Penlink sells Webloc as an add-on to its Tangles social media intelligence system, with marketing materials claiming the ability to monitor location, movements, and personal characteristics of populations up to three years in the past
- Cobwebs Technologies was deplatformed by Meta in December 2021 alongside six other cyber mercenaries for operating roughly 200 accounts used to surveil activists, opposition politicians, and government officials in Hong Kong and Mexico
- Investigations by 404 Media, Forbes, and the Texas Observer found Webloc can track phones without a warrant, with one procurement record highlighting the tool's ability to "automate and continuously monitor unique mobile advertising IDs, geolocated IP addresses, and connected devices analysis"
- Citizen Lab identified 219 active servers tied to Cobwebs product deployments, with 126 in the U.S., 32 in the Netherlands, 17 in Singapore, and 8 each in Germany and Hong Kong
- Penlink rejected the report, saying the findings "appear to rely on either inaccurate information or a misunderstanding about how we operate" and asserting compliance with U.S. state privacy laws
Why it matters: With 126 of 219 identified servers located in the U.S. and confirmed users spanning ICE, the U.S. military, and local police departments in cities like Dallas and Baltimore, the ad-data pipeline described by Citizen Lab shows how commercially harvested advertising identifiers became a warrant-free surveillance layer for domestic and foreign agencies. Penlink's blanket denial does not address the specific customer identifications, the three-year historical lookback, or the no-warrant reporting from 404 Media, Forbes, and the Texas Observer.
Ask SkimNews
