Analysis Of Penlinks Ad Based Geolocation Surveillance Tech

Targeted and mass surveillance based on everyday consumer data from mobile apps and digital advertising has been referred to as advertising intelligence (ADINT). We refer to it as “ad-based surveillance technologies.” These technologies have proliferated alongside the personal data surveillance economy. They are poorly regulated and often sold by firms that operate without transparency, raising serious security, privacy, and civil liberties concerns – especially when used by authoritarian governments that lack proper oversight.

In this report, we investigate, summarize and document what we know the ad-based geolocation surveillance system Webloc. Developed by Cobwebs Technologies, Webloc is now sold by Penlink, after the companies merged in 2023.

Webloc has recently sparked significant public debate as the U.S. Immigration and Customs Enforcement (ICE) entered into a contract which allows it to access data on hundreds of millions of people for surveillance purposes. In March 2026, 72 senators and representatives in the U.S. Congress called for an investigation into “warrantless purchases of Americans’ location data” by ICE and other U.S. agencies.

Based on documents related to contracts and other sources, we analyze in detail the capabilities provided by Webloc, which is sold as an add-on product to the widely used social media and web intelligence system Tangles. According to the documents we have seen, Webloc provides access to a constantly updated stream of records from up to 500 million mobile devices across the globe that contain device identifiers, location coordinates, and profile data harvested from mobile apps and digital advertising. Customers can monitor the location, movements, and personal characteristics of entire populations up to three years in the past. As discussed in Section 3 , our analysis of Webloc’s capabilities is based on a number of documents from 2021, 2022, 2023, and 2025.

Our research shows that intrusive and legally questionable ad-based surveillance (i.e. without a warrant or adequate oversight) is being used by military, intelligence, and law enforcement agencies down to local police units in several countries across the globe.

In collaboration with Hungarian journalist Szabolcs Panyi, who is publishing a parallel report via the European investigative platform VSquare, we reveal that domestic intelligence in Hungary has been using Webloc since at least 2022 and continues to use it as of today. This represents the first confirmation of the use of ad-based surveillance technology in Europe.

Based on a systematic analysis of media reporting, public records, and other sources, we show that El Salvador National Civil Police purchased Webloc in 2021. These sources also show that Webloc customers in the U.S. include the U.S. military, ICE, West Virginia Department of Homeland Security, Texas Department of Public Safety, NYC district attorneys, and police departments, both large and small, in Los Angeles, Dallas, Baltimore, Durham, Tucson, Pinal County and City of Elk Grove.

In Europe and the U.K., we sent 96 freedom of information (FOI) requests to law enforcement agencies and local police departments in 14 countries and to six European Union bodies. Many were rejected or received no response. Europol confirmed to hold information relating to Webloc but refused to disclose it. The U.K.’s Office and the Swedish Police Authority would neither confirm nor deny information requests relating to Webloc while stating they did not have access to products from similar vendors. Austrian, Dutch, and Romanian ministries refused to say whether they use Webloc. While five U.K. police departments confirmed to not hold information on Webloc, 39 would neither confirm nor deny.

We further examined potential Webloc customers in additional countries. The local police in Venice, Italy hosted a Webloc training event in 2022. Israeli military personnel received Webloc training while working for the Israel Defense Forces. A Dutch reseller promotes Webloc to European customers. Based on our technical analysis and other sources reviewed for this report, we believe that further research would be fruitful with respect to potential Webloc purchases in the Netherlands, Mexico, Vietnam, and Singapore. The maps shown in documents that describe Webloc indicate that it was used to track people in Germany, Austria, Italy, Hungary, Romania, United Arab Emirates, Israel, Singapore, and Russia.

Based on technical analysis, we mapped out server infrastructure that we attribute to deployments of Tangles, Webloc or other products developed by Cobwebs Technologies. The analysis shows that servers affiliated with Cobwebs Technologies are located in many countries including in the U.S., U.K., Israel, Netherlands, Germany, Sweden, Norway, Italy, France, Ireland, Hungary, Poland, Cyprus, Mexico, Colombia, Brazil, Australia, Japan, Singapore, Hong Kong, India, Indonesia, United Arab Emirates, Iraq, and Kenya. We do not know whether the server locations represent customers located in these countries.

Analysis of corporate records and other public information indicates that Cobwebs Technologies is linked to the spyware vendor Quadream. Omri Timianker, the founder and former president of Cobwebs Technologies who now oversees Penlink’s international operations, holds an indirect interest 1 in Quadream. A former key executive and investor in Cobwebs Technologies is a key investor in Quadream. The Citizen Lab previously revealed that Quadream’s spyware was used to target civil society, journalists and political opposition figures. Quadream was reportedly trying to sell its assets in 2023, but it is unclear whether they have and its Israeli corporate entity is still operational.

We briefly investigate other products developed by Cobwebs Technologies. Lynx, a system that helps facilitate undercover operations on the web and manage fake accounts on social media platforms, was used in the U.S. and El Salvador, as suggested by public records and media reports. Another system named Trapdoor, by Cobwebs Technologies as an “active web intelligence” solution, has rarely been reported anywhere. A “technical specifications” document refers to Trapdoor as a “social engineering platform.” The document and technical analysis suggest that Trapdoor is or was a system that helps customers create fake web pages and send phishing links to victims in order to trick them into revealing information. Our analysis further suggests that Trapdoor can help facilitate the deployment of malware on a victim’s device. Based on technical analysis, we identified potential Trapdoor servers located in Kenya, Indonesia, Singapore, Hong Kong, U.A.E., and Japan. We do not know whether Lynx and Trapdoor are still being sold by Penlink. In its response to the Citizen Lab, Penlink claims, without being specific, that our report describes “products that no longer exist.”

The U.S. Department of Homeland Security (DHS) used Tangles to compile dossiers on protesters, according to an internal DHS report, as discussed in Section 2 . Meta mentioned Cobwebs Technologies prominently in its 2021 “Threat Report on the Surveillance-for-Hire Industry,” banning it from its platform. Meta observed accounts used by Cobwebs customers engaging in social engineering and tricking people into revealing information including “frequent targeting of activists, opposition politicians and government officials.” Cobwebs Technologies stated the report was false.

We adopted a multi-method research design for this report. We conducted a comprehensive desk-based review of online sources (both current and historical), including media reporting, marketing materials, contracts, and publicly available procurement records. For our corporate mapping research, we obtained corporate filings from official company registries. To ascertain which governments in Europe have had access to Webloc, or currently have access, we sent 96 freedom of information (FOI) requests across Europe. Our FOIs spanned 14 countries and six European Union bodies. For the most part, we sent these requests to agencies responsible for immigration and law enforcement. We also appealed several refusals by government agencies to provide information in response to our FOIs. We also worked in collaboration with Szabolcs Panyi, a Hungarian journalist, to confirm the sale of Webloc to the Hungarian government. Panyi relied on primary documents shared with him and several anonymous sources with ties to the Hungarian intelligence industry to confirm his findings. We independently reviewed a partial selection of these documents. We also performed technical research by using browser testing on publicly available web resources and common DNS, IP, and URL telemetry tools. We mapped out the server infrastructure we consider to be associated with Cobwebs Technologies and products developed by the company.

In February 2020, an investigation by Byron Tau published in the Wall Street Journal confirmed for the very first time that U.S. government agencies purchase commercial smartphone data that maps the movements of millions for surveillance purposes. His article revealed that ICE bought access to location data from a digital marketing firm that obtained it from ordinary consumer apps, such as games or weather apps, to track immigrants.

Since then, investigations by journalists , researchers , and policymakers have shown that many government agencies in the U.S. have bought data on the behaviours, personal characteristics, and locations of hundreds of millions of people gathered from mobile apps and digital advertising firms. This includes a U.S. military unit that conducts drone strikes, an intelligence agency that used it for domestic surveillance without a warrant, and federal , state and local law enforcement.

Targeted and mass surveillance based on commercial data from mobile apps and digital advertising has been referred to as “advertising intelligence” (ADINT), a term that was reportedly coined by the surveillance industry itself. We refer to it as “ad-based surveillance technologies.” While the public has learned a lot ad-based surveillance vendors and their customers in the U.S . in recent years, as well as vendors in other regions , little is known how ad-based surveillance is used across the world in regions other than the U.S.

Ad-based surveillance vendors and their customers typically obtain mobile app and digital advertising data either from SDK-based or RTB-based sources , as confirmed by U.S. government records .

RTB-based data sources access data streams from the real-time bidding (RTB) system in digital advertising. Every time a person uses a mobile app or website that displays ads, an auction determines what ad they see. During that auction, which occurs within less than a second, their user data (described in more detail below) is shared with dozens or hundreds of digital marketing firms who participate in the bidding process. As the data is broadcasted without any security measures, surveillance vendors access it either by buying it from data brokers or by participating in the ad auctions themselves. An average European citizen’s data is broadcasted to an unknown number of parties a few hundred times a day. 2

SDK-based data sources access data via third-party tracking software embedded in mobile apps. Many apps installed on Android and iOS phones, whether a game or a dating app, contain tracking software from one or several third parties. App vendors embed third-party software into their apps because they want to add functionality, analyze their users, benefit from displaying ads or simply sell user data. This third-party software is often integrated into an app in the format of a so-called software development kit (SDK). Surveillance vendors typically access the data by buying it from data brokers who directly or indirectly operate third-party software embedded in apps. 3

The raw data collected from both types of sources typically consists of a device identifier, a timestamp, and other attributes that describe a person’s behaviour or characteristics, such as their current geolocation, the app used at the time of collection and information their device, operating system, and language. RTB-based data sources can provide additional attributes such as a person’s age, gender, interests, habits, and purchases, which are used for ad targeting. SDK-based data sources can potentially access all data that the mobile app they are embedded into can access. This can include in-app behaviour, data on nearby Wi-Fi access points and Bluetooth devices, or even data from sensors such as the gyroscope, which measures how a phone is being held and moved.

Device identifiers are essential to track, follow, and profile people both in digital marketing and in ad-based surveillance. Data collected from both RTB- and SDK-based sources contains so-called Mobile Advertising IDs (MAIDs), which identify a phone or other mobile device and the person using it. While the advertising industry has long argued that advertising IDs were ‘anonymous’, they are widely used to track, follow, and profile people both in digital marketing and by surveillance vendors who sell to governments.

The U.S. Federal Trade Commission (FTC) recently clarified that Advertising IDs “offer no anonymity in the marketplace,” because “many” businesses “regularly link consumers’ MAIDs to other information them, such as names, addresses, and phone numbers.” As both RTB-based and SDK-based surveillance rely on advertising IDs or other identifiers used in digital marketing, we refer to both as ad-based surveillance. Both may also utilize the IP address of the user for identification purposes.

One data broker who obtained RTB-based data and sold that data to U.S. federal government customers via defence contractors claimed to have data on more than one billion mobile devices . Another one collected RTB-based data from thousands of apps . Data brokers that obtain SDK-based data typically collect data on a lower number of people. One company who sold to the U.S. military via another firm claimed to collect data from 40 million phones via its SDK embedded in 400 apps , including Muslim prayer and family safety apps . A recent document referring to ICE’s purchase of the geolocation surveillance system Webloc discusses “billions of daily location signals from hundreds of millions of mobile devices.”

The types of data that can be obtained from a phone depend on the apps installed on the device, the data those apps can access, and the permissions granted by the user. This specifically applies to geolocation tracking, which represents a major use case for ad-based surveillance. Apple’s App Tracking Transparency initiative, and to a much lesser extent, Google’s improvements in Android permissions , have restrained access to geolocation data. To circumvent those restrictions, data collection efforts focus on apps that require access to location data such as weather, , fitness, and dating apps.

When the exact GPS location of a user is unavailable, data brokers infer the approximate location at the city level from the user’s IP address . SDK-based data may also contain location records inferred from data on Wi-Fi access points nearby a mobile device. Another obstacle lies in the fact that much of the data harvested and traded for digital marketing purposes is inaccurate . This is specifically true for geolocation data, as confirmed by the industry itself. For targeted surveillance, however, it does not matter whether 90% of the data is flawed, as long as the target’s device identifier is in the set.

Location data and similar data collected from apps and digital advertising are highly sensitive. They can reveal information a person’s , workplace, family, friends, religion, political views, sexual orientation or health issues. The systematic misuse of data on hundreds of millions of people purchased from everyday consumer apps and digital advertising for warrantless surveillance raises serious concerns civil liberties and fundamental rights . In the U.S. and in Europe, both the lawfulness of governments using ad-based data for surveillance and the lawfulness of sharing the data over the entire supply chain, from apps and advertising firms to data brokers and surveillance vendors, are highly controversial, as discussed in Section 10 .

The ad-based surveillance system Webloc was initially developed by the Israeli company Cobwebs Technologies, which has been selling a range of surveillance technology solutions to national security organizations, law enforcement agencies, and commercial clients. Founded in 2015 by former members of Israeli special forces and intelligence units , Cobwebs Technologies was acquired by the U.S. investment firm Spire Capital in 2023 and merged with Penlink, a U.S.-based surveillance technology vendor also owned by Spire Capital. The three founders of Cobwebs Technologies have since taken over key executive roles at Penlink, leading its technology, product, marketing, strategy, and international sales initiatives.

According to corporate records, Cobwebs Technologies has operated corporate entities in Israel, U.S., U.K., Germany, Singapore, and New Zealand. 4 A 2021 version of its website also listed offices in Mexico, Indonesia, and India. After it became part of Penlink in 2023, the Israeli, U.K. and German entities were renamed to contain the term “Penlink” or “Pen-link” instead of “Cobwebs.” 5 Several products developed by Cobwebs Technologies are now sold by Penlink.

Cobwebs Technologies’ product portfolio has been centred around its web and social media investigation platform Tangles, accompanied by additional products for mobile location surveillance, financial intelligence, cybersecurity, and covert social media operations.

Developed by Cobwebs Technologies, Tangles is a software platform that provides access to data from social media and the open, deep, and dark web. It has been referred to as a “web investigation platform,” “web intelligence platform” or “WEBINT” system. According to leaked training manuals , government and commercial customers can for keywords and personal identifiers like names, email addresses, phone numbers, and usernames to identify online accounts and then analyze what they post, their interactions, relationships, activities, event attendances, and interests. They can monitor and profile individuals, create “target cards,” receive alerts, analyze geolocation information extracted from posts and photos, and perform network analyses, for example, to identify groups based on their mutual friends or workplaces.

According to service definitions in U.S. procurement records, 6 data sources include web forums, blogs, text storage sites (also known as pastebins ) and social media platforms such as , Instagram, Twitter/X, YouTube, , SnapChat, TikTok, , VK, Weibo, Parler, and Gab. They also include the dating platform Tinder and “messaging sources” such as Telegram, Viber, and Truecaller. Tangles also analyzes information from and Telegram groups, Marketplace, and the payment service Venmo.

The system’s image processing module detects objects and landmarks in a given photo. It also provides facial recognition, and includes the capability to for individuals based on their photos, according to a leaked technical proposal related to a contract in El Salvador. Tangles focuses on publicly available data and is now by Penlink as an “open source intelligence” platform powered by “AI.” It is not clear whether Tangles incorporates personal data purchased from data brokers.

The ad-based surveillance system Webloc, which is the main subject of this report and further examined in the sections, analyzes data on the behaviours and movements of hundreds of millions of people. In contrast to Tangles’ focus on publicly available data from the web and social media, Webloc relies on data purchased from mobile apps and digital advertising. It relies on the re-purposing of behavioural data originally collected for the purposes of operating consumer apps or delivering ads for surveillance. The lawfulness of such repurposing is addressed in Section 10 . Introduced in 2020, Webloc provides the capability to monitor the whereabouts, movements and personal characteristics of entire populations. It is sold as a Tangles add-on product, but customers have to purchase a separate Webloc license in order to use it, according to our research Webloc customers in the U.S.

Lynx is another Tangles add-on product that provides investigators and intelligence analysts with the capability to anonymously browse the web and use social media platforms with fake identities and accounts via what is advertised as a global proxy infrastructure. In 2020 and 2021 , Cobwebs Technologies Lynx as a system for “Virtual HUMINT Operations” that helps create, manage, and maintain “virtual agents” with the “click of just one button.” According to a leaked technical proposal related to a contract in El Salvador, Lynx provides “avatar management” and “virtual agents” across “email, social networks, forums” with “support for various social media platforms.” 7 Documents obtained from the Los Angeles Police Department (LAPD) via a freedom of information request describe Lynx as a system to “collect data from various virtual HUMINT sources online” by “creating and using avatars (virtual agents).” Media reports and public records suggest that Lynx was purchased in El Salvador and by U.S. federal agencies like DHS and the Internal Revenue Service (IRS). We do not know whether Lynx is still being sold by Penlink.

Another product, named Trapdoor, has rarely been reported or mentioned anywhere. In 2021, Cobwebs Technologies Trapdoor on its website as a system for “active web intelligence.” As briefly examined in Section 8 , a specifications document and technical analysis suggest that Trapdoor is a “social engineering platform” that helps customers to create fake web pages and send phishing links to victims in order to trick them into revealing information, including passwords. Our own analysis further suggests that Trapdoor allows customers to extract device information such as battery level, access a device’s camera and microphone, remotely open hidden tabs in the victim’s web browser and deliver “payloads” to them. Based on our analysis, we assess that Trapdoor can help facilitate the deployment of malware on a victim’s device but does not include remote device infection or malware capabilities itself. We do not know whether Trapdoor is still being sold by Penlink, and we could not identify any Trapdoor customers. During our analysis of Cobwebs Technologies’ server infrastructure, we identified active servers located in Kenya and Indonesia that display Trapdoor login pages in the web browser and four additional servers that may be associated with Trapdoor deployments.

Weaver was as a “financial investigation platform” that helps financial institutions address everything from fraud, money laundering, and cyber threats to reputation risks through monitoring “natural persons, companies, and other entities seeking to become clients, partners, or employees of the institution.” We assume that Weaver is basically a Tangles version for financial institutions. We could not identify any Weaver customers. During our analysis of Cobwebs Technologies’ server infrastructure , we identified one active server displaying a Weaver login page in the browser.

Cobwebs Technologies also provided a Threat Intelligence Platform that relies on “huge sums of data” from the “open, deep, dark web and external sources.” We assume that this product is or was a Tangles version for the cybersecurity sector. We could not identify any customers.

Since 2023, Tangles and Webloc have been sold by Cobwebs successor Penlink, according to our research on Webloc customers. We do not know whether Lynx, Trapdoor, Weaver, and other products developed by Cobwebs Technologies are now also being sold by Penlink. They are not on Penlink’s website. However, we identified servers active in 2026 that show login pages for Weaver and Trapdoor in the browser, according to technical analysis . In its response to the Citizen Lab, Penlink claims, without being specific, that our report describes “products that no longer exist.”

Penlink is a surveillance technology vendor based in the U.S. Founded in 1987, it provides software that helps law enforcement agencies wiretap telecommunications customers and social media users based on warrants. Penlink’s PLX product helps to retrieve, organize, and analyze call records, histories, login data, and other information from AT&T, Verizon, T-Mobile, Comcast, Google, and other companies. In 2022, Penlink had contracts worth $20 million a year with U.S. federal agencies like ICE, FBI and DEA and many other contracts with local and state police, according to Forbes.

According to its website , Penlink is now selling PLX, Tangles and other products including CoAnalyst, a “digital investigation” platform utilizing “generative AI.” A promotional document published by journalist Joseph Cox in 2026 describes Penlink’s “digital intelligence package for national security” consisting of Tangles, Webloc and another product not mentioned anywhere else, WebEye. Originally in Portuguese, the document describes WebEye as a system for “investigations of web pages and browser session extraction.” In Penlink’s response to this report, the company describes itself as “committed to delivering tools for law enforcement to rapidly , analyze, and identify threats to keep our communities safe” and claims that its “customers use these tools and capabilities to locate kidnapped children, combat human and drug trafficking, and identify potential terror threats, among other critical uses.”

The use of Webloc to collect data from mobile apps and digital advertising from entire populations for surveillance, which is further examined in the sections of this report, raises concerns civil liberties, warrantless surveillance, and data protection, as discussed in Section 10 .

However, it is not only Webloc that generated controversial public debate in recent years:

The findings laid out in the sections raise additional concerns, from the intrusive nature of Webloc, its customers and potential uses to the links between Cobwebs Technologies and the spyware industry.

Cobwebs Technologies announced the introduction of Webloc in 2020 and it as a “location intelligence platform” that is “designed to meticulously race through and scan endless digital channels from the web ecosystem, collecting and analyzing huge sums of location-based data.” According to its 2021 website , Webloc “provides access to vast amounts of location-based data in any specified geographic location,” relying on “billions of data points” from “different types of large datasets.” Soon thereafter, Cobwebs removed the page on Webloc from its website.

While the web intelligence system Tangles has always been heavily , information on Webloc has notably disappeared from public view in recent years. As of 2026, Webloc is mentioned only once on the Penlink website. On a page a Tangles training course, Penlink offers a “Webloc Fundamentals” course.

Cobwebs Technologies and its successor Penlink do not provide much robust information Webloc’s capabilities and data processing practices. Our analysis in this section is largely based on documents dated 2021, 2022 and 2023, including a leaked technical proposal, technical specifications we discovered on the web, Webloc release notes we received from a research partner and public records related to Webloc contracts. A Penlink document that we believe was created in 2025 confirms the basic capabilities identified in our analysis but provides less detail. Further, in response to this report, Penlink provided some additional information regarding Webloc.

We obtained from a research partner a leaked document related to a Webloc contract with El Salvador National Civil Police. This document provides a comprehensive overview of Webloc including several screenshots of the user interface. The document, dated February 2021, is titled “Technical Proposal” (Spanish original “Propuesta Técnica”), and comes from the Mexican company EyeTech Solutions, who resold Tangles, Lynx and Webloc to El Salvador police, as reported by El Faro in 2023. We have reproduced the leaked document here . 8

According to the document, Webloc provides access to a constantly updated stream of geolocation records from 500 million phones and other mobile devices from across the globe.

The screenshot in Figure 2 (below) shows the Webloc user interface. In this example, the system tracked a male person currently located in Abu Dhabi, who has 141 apps installed on his mobile phone, some of which sent 81 different GPS location coordinates to the system over the past five days. In addition, he was apparently located based on Wi-Fi access points nearby his phone 110 times. The activity graph on the right bottom indicates that the system tracked his location up to 12 times a day.

The person’s profile and location records are linked to a unique identifier, displayed in the screen at the right top above the map. This type of identifier is known as a mobile advertising ID and represents a unique identifier assigned to his phone.

Another example screen demonstrates how Webloc tracked a person travelling from Germany via Austria to Hungary, based on analyzing 39 past location records out of 500 recorded by the system.

Webloc customers can start a surveillance operation by searching for mobile devices that were present in a certain area, which is referred to as a “perimeter” or “geofence.” They can also identify devices that were located in two or more defined areas within a certain period of time, indicating persons travelling from one place to another, according to the El Salvador document.

The screenshot in Figure 4 shows Webloc displaying a list of 1,433 location records of persons whose mobile devices were located in certain areas in both Italy and Romania within a certain time period. For two devices, identified by their mobile advertising IDs, the system captured three location records in both Italy and Romania.

Another example screen ( Figure 5 ) from the El Salvador document illustrates how Webloc visualizes the driving or walking routes of persons located within a few blocks in a Tel Aviv neighborhood, and includes a timeline. In total, the system tracked the locations of 103 persons in the area.

Webloc is not limited to location tracking; it provides access to a wide range of information each person whose phones are constantly broadcasting personal data to digital advertising firms or data brokers via the apps installed on their devices.

The table in Figure 6 (below) from the El Salvador document presents an example user profile for a male person aged 18-24 located in Hungary who uses a Samsung Galaxy S8 Android phone with the device language set to English. In addition, it lists a set of “user segments” that describe characteristics and behaviours typically used for ad targeting in digital marketing. In this example, the person was classified as a regular commuter who is interested in basketball and buying luxury goods. The profile also indicates whether the tracked person is a parent, a gamer, or a traveller.

The “user segments” section in the profile shows ad targeting categories typically used in digital advertising, which specifically suggests that Webloc obtains data from sources that are related to digital advertising. While the attributes shown in the example screen relate to personal characteristics that may seem not too sensitive, many segment attributes typically used in digital advertising reveal everything from employment, political views, religion and sexual orientation to pregnancy, health issues or personal debt.

We analyzed additional documents that contribute to our understanding of Webloc. A document 9 related to a contract that was published in 2021 by the Office of Naval Intelligence, the U.S. Navy’s military intelligence agency, indicates that Webloc provides the ability to “continuously monitor unique mobile advertising IDs” for both Android and iOS devices, 10 linked to geolocation data including Wi-Fi location, device information, age, gender, language, interest categories, and data on the apps “installed and used.”

According to a Vietnamese “Technical specifications” document dated 2021 and branded “Cobwebs Technologies,” Webloc collects and analyzes mobile records that contain advertising ID, timestamp, geolocation coordinates based on GPS or Wi-Fi, IP address, carrier information, Wi-Fi name, device type and operating system, age, gender, locale, apps used and ad targeting segments. 11 It emphasizes the same three profile categories (parent, traveler, gamer) as mentioned in the El Salvador document and suggests that Webloc provides functionality to export the raw data in CSV format. 12

A Penlink-branded promotional document 13 published by the journalist Joseph Cox in 2026 confirms that Webloc provides very similar capabilities today. The document was created in 2025, according to PDF metadata. It is written in Portuguese and describes a “digital intelligence package for national security” consisting of Tangles, Webloc and other products. An example screenshot shows location records associated with advertising IDs and a list of apps installed on a phone. Another document discussed by Cox suggests that Webloc has added the capability of inferring location from IP addresses, supplementing the systems’s GPS and Wi-Fi location capabilities.

As discussed in the background section, advertising IDs referring to mobile devices can be used to track, follow, profile, and identify the persons who use those devices. Many parties can easily retrieve the name, email address and phone number associated with an advertising ID, and vice versa. Even if it was not possible to link the pseudonymous device identifier utilized by Webloc to a name, location records can still identify individuals in many ways.

According to the El Salvador document, identifying the persons behind the devices is the purpose of Webloc. The document emphasizes that it would be vital for analysts who use Webloc to identify the actual person behind the device, for example by identifying their addresses and workplaces.

The system’s heat map functionality can show where a device was typically located during the day and night. Referring to the example screen in Figure 7 displaying a map of Singapore, the document explains that it would be safe to deduce the address and workplace based on the map shown in this example (see Figure 8 ). The document also suggests sending “ground forces” to locations associated with a “suspect.” 14 As detailed in Section 5 , local police in Tucson, Arizona, explained in an internal report how it used Webloc to identify the apartment address and workplace of a person and his romantic partner.

Both the El Salvador and the Vietnam documents explain that the names of Wi-Fi access points 15 a tracked individual connected to, as shown in Figure 7 , can reveal last names, workplaces or other venues visited by them.

According to a document related to a Webloc contract with a U.S. law enforcement agency dated 2023, 16 the system provides “special agents” with an “unapparelled [sic] ability to develop investigative leads.” The U.S. Navy document dated 2021 states that Webloc provides the capability to “find and establish relevant and meaningful relationships and connections to individual’s virtual and physical patterns of life.” To “enhance target identification and tracking,” the system could additionally combine mobile advertising data with imported “cellular data dumps,” likely referring to phone and geolocation data obtained from telecommunications network operators.

Webloc can display location records not only on a map but also in Google Street View, as the example screen ( Figure 9 ) from the El Salvador document illustrates. It shows multiple records represented by red pins, all of them possibly associated with the same person who was frequently located in front of a certain house in St. Petersburg, Russia.

Webloc supports a variety of query and network analysis capabilities, ranging from queries for location records linked to a particular known mobile device ID to retrieving records for all devices that were observed in one or several specified areas, according to the El Salvador and Vietnam documents. The system can send alerts when monitored devices are located at a new place or when new devices enter a monitored area.

A document titled “Webloc Release Notes 6.5” we received from a research partner dated September 2022, explains how the system’s “Cross Analysis – Connections” tool can help reveal associations between devices and their owners based on the places they have visited, as illustrated in the example screen in Figure 10 .

Webloc provides both historical data and a constantly updated stream of new location records. According to the El Salvador and Vietnam documents, the data is updated every four to 24 hours. The system provides three years of historical data, according to a 2023 document related to a Webloc contract with a U.S. law enforcement agency.

The following table summarizes the types of personal data processed by Webloc as of 2021, according to the El Salvador, Vietnam, and U.S. Navy documents:

The documents claim that data collection complies with the General Data Protection Regulation (GDPR) and “various” privacy laws and that it is collected with the “consent” of those who are monitored by the system. We further those claims in Section 10 .

In its response to the Citizen Lab, Penlink says that Webloc “contains only location data (sometimes precise, and sometimes non-precise location data) tied to device identifiers. It does not include age, gender, parenthood, interest categories, or website visited.” We cannot verify this claim. Even if age, gender and interest categories were not included in Webloc anymore, location records reveal information someone’s habits, interests and personal characteristics. A Penlink-branded document 17 published by the journalist Joseph Cox, which was created 2025 according to PDF metadata, explains that Webloc “generates demographic insights” and facilitates “detailed identity and lifestyle pattern resolution”. 18

Public reporting provides information on how similar ad-based surveillance vendors in the U.S. obtain the data, which data brokers they bought from, and how they participated in the digital advertising sector themselves. Yet, despite spending a considerable amount of resources investigating potential Webloc data supply chains, it remains opaque to us. We are currently not able to make a solid conclusion how Penlink obtains Webloc data today. It might obtain data from SDK-based sources, RTB-based sources or a mix of both, either directly or indirectly via other data brokers. In its response to the Citizen Lab, Penlink says that it “obtains its location data from providers who obtain user consent for location data sharing through SDKs and who filter out sensitive locations from their datasets, consistent with FTC mandates.”

Several sources, including the El Salvador and Vietnam documents, both dated 2021, suggest that Webloc obtained data via mobile app SDKs, which are third-party tracking software systems embedded in mobile apps, also in 2021. The documents show how Webloc displays data on Wi-Fi access points, including their names. SDK-based data sources can potentially access Wi-Fi data. Sources that obtain the data from the RTB bidstream in digital advertising cannot access it. This suggests that Webloc actually obtained the data from SDK-based sources in 2021.

However, several attributes processed by Webloc in 2021 are often obtained from RTB-based sources, including age, gender, and the attributes related to user segments and ad targeting categories. These attributes may be also accessible via mobile app SDK. Whether obtained from SDK-based or RTB-based sources, these attributes clearly indicate that the data is associated with digital advertising.

Almost certainly, Webloc’s data sources are different in 2026. The data supply chains for surveillance technology vendors that obtain data from mobile apps and digital advertising are constantly changing. Data brokers that harvest data on behalf of ad-based surveillance vendors have been repeatedly cut off from their app data sources.

According to the El Salvador document, Webloc obtained data from 500 million mobile devices that were tracked at least once in a month in 2021, with global coverage that varies per region. We are not able to assess the actual current coverage, quality, and accuracy of the data processed by Webloc.

This section analyzes and documents what we know the customers and uses of the geolocation surveillance system Webloc.

First, we present a summary of U.S. customers including federal agencies such as ICE, the U.S. military and law enforcement agencies in several states, cities, and counties, based on a systematic screening of media reports, public records, and responses to freedom of information requests. In addition to widely reported customers, we identified a number of contracts that were rarely or not yet reported to our knowledge.

Secondly, alongside reporting from Szabolcs Panyi at VSquare, we show that domestic intelligence in Hungary use Webloc. These are novel findings that have not been previously reported.

Thirdly, we document El Salvador National Civil Police’s purchase of Webloc in 2021 and 2022, which was rarely reported outside the country.

Current Webloc customers include Immigration and Customs Enforcement (ICE), the controversial federal agency that was involved in fatal shootings that may amount to extrajudicial killings and has been accused of routine detainments without warrants and probable cause. ICE purchased Tangles and Webloc licenses worth up to $2.3 million for the term of September 2025 to September 2026, according to a publicly available document 19 related to the contract 20 first reported by 404 Media .

The Office of Intelligence of Homeland Security Investigations (HSI), 21 one of the two ICE law enforcement units, uses the system to “support domestic and international investigations into cross-border crimes,” according to the document. ICE had already bought licenses for Cobwebs and Tangles between 2022 and 2025. A pricing proposal obtained by Tech Inquiry via a freedom of information request suggests that the 2022-2023 contract also included Webloc.

In 2023, the Department of Homeland Security (DHS) released an internal report 22 which found that several DHS entities, including ICE, violated federal law through their purchases of “commercial telemetry data (CTD) collected from mobile devices that included, among other things, historical device location.” The report does not mention vendors but confirms that ICE had been purchasing such data starting in 2019. ICE stated that it had stopped using the data in late 2023. We consider ICE a Webloc customer in 2025-2026 and a potential Webloc customer in 2022-2023.

The U.S. military purchased Webloc on at least two occasions. In 2021, the Navy’s military intelligence agency, the Office of Naval Intelligence, purchased annual Webloc licenses, according to a publicly available document related to the contract, 23 first reported by one of the authors of this report. 24 In 2022, the U.S. Army Space and Missile Defense Command (USASMDC) purchased annual Tangles and Webloc licenses 25 as part of a large contract awarded to the defense contractor Science Applications International Corporation (SAIC), 26 which was not reported to our knowledge. We consider the U.S. Navy’s Office of Naval Intelligence a Webloc customer in 2021-2022 and the U.S. Army’s USASMDC a Webloc customer in 2022-2023.

Documents suggest that the Bureau of Indian Affairs Police (BIA-OJS), a law enforcement unit of the U.S. Department of the Interior’s Bureau of Indian Affairs (BIA), purchased Webloc. In 2023, BIA entered a five-year Tangles contract on behalf of BIA Police, according to contractual documents obtained by Tech Inquiry via a freedom of information request. While the contract does not mention Webloc, it clearly describes Webloc capabilities.

The Department of Homeland Security (DHS) of West Virginia has been a Webloc customer since 2021. DHS West Virginia Fusion Center entered two three-year contracts including both Tangles and Webloc, one beginning in 2021 , and the other in 2024 . The effective end date of the 2024 contract (which consists of an initial one-year period and two subsequent one-year periods that are subject to annual renewals) is June 2027. We are not aware of public records confirming annual renewals. We consider DHS West Virginia a Webloc customer from 2021 to 2025 and a potential Webloc customer until 2027.

The Texas Department of Public Safety (DPS) is also a long-term Cobwebs customer. As first reported by The Intercept , Texas DPS initially purchased Tangles and Webloc in 2021 as part of the Texas Governor’s “Border Disaster” efforts. The initial annual contract on behalf of the Texas DPS’ Intelligence and Counterterrorism division worth $198,000 included both Webloc and Lynx, according to media reporting and documents obtained via freedom of information requests shared with the Citizen Lab. Texas DPS also purchased Tangles in 2022 and 2023. In 2024, it entered into a five-year Tangles contract worth $5.3 million for 230 users, according to the Texas Observer. In response to records requests for the years 2023 and 2024, Texas DPS stated to have seven investigative reports and no incident reports that mention the terms “Cobwebs” or “Tangles.” It refused to release the documents for public safety reasons. We consider Texas DPS a Webloc customer from 2021 to 2022 and a potential Webloc customer from 2023 to 2029.

Webloc customers also include police departments and other law enforcement agencies in both larger and smaller cities and counties in California, Texas, Maryland, North Carolina, New York and Arizona.

The Los Angeles Police Department (LAPD) entered into a one-year Tangles and Webloc contract in 2022, as initially reported by Knock LA, which obtained documents via freedom of information requests. When asked Webloc, the LAPD stated it uses “commercially available anonymized data in relation to criminal investigations.” A LAPD report, which does not distinguish between Tangles and Webloc, states that the Cobwebs system was used by the Robbery-Homicide Division (RHD) and Major Crimes Division (MCD), and it had been queried 136 times in 2022 and 1,319 times in 2023. We consider LAPD a Webloc customer from 2022 to 2023.

Dallas Police Department (DPD) has been a Webloc customer at least in 2025, according to a statement DPD provided to the Dallas Observer. Public records show that the City of Dallas authorized a three-year purchasing agreement for Cobwebs software worth $303,963 in January 2025. DPD claims that Webloc is not “not widely used” in the department. The system is used by DPD’s Fusion Center, according to a city council member. We consider Dallas police a Webloc customer in 2025 and a potential Webloc customer until 2028.

The Baltimore County Police Department purchased Webloc in 2022 on behalf of its Crime Strategies and Analysis Division in order to “properly plan for public safety issues and events,” according to public records . In 2024, it entered a three-year Tangles and Webloc contract subject to annual renewals. In 2021, Baltimore County purchased an annual license representing a “continuation of a subscription” for the “Cobwebs Technologies Web Investigation Platform” Tangles, and it had a supplier contract with Cobwebs Technologies also between 2023 and 2024. We consider Baltimore County police a Webloc customer from 2022 to 2024 and a potential Webloc customer for the entire period from 2020 to 2027. This was not reported to our knowledge.

Tucson police explained in an internal report that Tangles and Webloc were “purchased for sex trafficking investigations” but readers “will see it has applications that span across the agency.”

The system was also used to monitor protests during visits of presidential and vice-presidential candidates. The purchase was paid for with money from Arizona’s Border Security Fund.

While the system was purchased for border security purposes and sex trafficking investigations, it was used for routine criminal cases with damages of a few thousand dollars and for monitoring protests.

The police department of the city of Durham, North Carolina, entered into a three-year Tangles and Webloc contract in 2024, according to a publicly available contract 29 including a quote 30 that refers to both Tangles and Webloc being part of the contract. While the contractual document is not signed, the city council authorized the purchase. We consider Durham Police Department a Webloc customer from 2024 to 2025 and a potential Webloc customer from 2026 to 2027. This was not reported to our knowledge.

In 2023, the police department of the City of Elk Grove, California, entered into a five-year Tangles and Webloc contract, according to documents obtained by EFF via a freedom of information request. The documents also include invoices and payment confirmations for the annual renewal in 2024. A city council record suggests that the system is used by Elk Grove police’s “Real-Time Information Center (RTIC)” to investigate crimes and “proactively provide leads in developing new investigations” including for “sex traffi...