Recent investigative reporting and technical analysis have highlighted Webloc, an ad-based geolocation surveillance system used by multiple law enforcement and intelligence-related organizations. The work, associated with Citizen Lab at the University of Toronto and conducted with supporting partners, describes a platform that can support tracking of hundreds of millions of mobile devices by repurposing signals generated through mobile advertising ecosystems.

This article summarizes what has been reported about Webloc, how the system is said to function, who has been named as using it, and why privacy and oversight concerns have been raised. The focus is on the technology’s mechanics and the implications of collecting and analyzing location-linked advertising data at scale.

What Webloc Is and Why It Matters

Webloc is described as a geolocation surveillance platform built to infer where people are and how they move. According to the reporting, the system was originally developed by Cobwebs Technologies, an Israeli company, and later sold through Penlink after a merger between the companies in July 2023.

The significance of the system stems from the combination of two elements:

Massive scale, with estimates in the reporting reaching up to 500 million devices.
Data repurposing, where information obtained within advertising and app ecosystems is used to support location tracking.

How Ad-Derived Location Tracking Works

One of the core claims in the analysis is that Webloc uses an advertising intelligence pipeline often referred to as ADINT. In practical terms, the system is described as ingesting multiple types of inputs that, when combined, can strengthen location inference and enable persistent device-level tracking.

The reported data flows include:

Mobile advertising identifiers (MAIDs) that can be observed within real-time bidding and mobile app ecosystems.
Location signals, including GPS and Wi-Fi-derived coordinates when available.
IP addresses, which can contribute to coarse geolocation.
Behavioral and device characteristics that help establish profiles.

The analysis further describes capabilities such as processing billions of location signals daily and supporting historical queries with retention periods reported as extending up to three years. With those capabilities, a system of this type can be used to reconstruct movement histories, identify probable locations associated with particular users, and support ongoing monitoring.

Key Surveillance Capabilities Highlighted in the Report

Several functions are emphasized in the reporting as central to the system’s usefulness for surveillance workflows:

Device-level continuity: the ability to treat a device as a persistent entity across time.
Movement reconstruction: mapping location signals into timelines of activity.
Location inference: deducing probable addresses, including home or workplace-like locations, from aggregated observations.
Automated analysis at scale: turning large datasets into searchable intelligence outputs.

Importantly, these capabilities are described as being supported even when direct GPS access is not uniformly available, because multiple signal sources can be combined to improve location estimates.

Named Users and Deployment Examples

The reporting names multiple organizations associated with law enforcement, policing, and intelligence activities. It also describes deployments across different jurisdictions.

In the United States, the following examples are included in the reporting:

Immigration and Customs Enforcement (ICE), described as having a $2.3 million contract (Fall 2024).
Texas Department of Public Safety, described as having a $5.3 million, five-year deal (2025).
Additional references to DHS and U.S. military-related activities are cited in the broader reporting context.
References to city-level and district attorney or prosecutorial uses, including New York City, are also mentioned.

Internationally, the reporting includes examples such as:

Hungarian domestic intelligence, described as using the system since at least 2022 with a license renewal in March 2026.
El Salvador’s National Civil Police, described as deployed since at least 2021.

The names and contract figures represent the core public-facing allegations described in the referenced summary. Organizations implicated by the reporting have been characterized as disputing aspects of the findings, including the interpretation of the evidence and assertions about legal compliance.

Why Privacy and Oversight Concerns Have Been Raised

Concerns described in the reporting focus on whether ad-derived datasets can function as a substitute for traditional location surveillance with warrant-based safeguards. Several major issues are commonly discussed in the context of systems like Webloc.

Warrantless or limited judicial oversight: Because the data originates in advertising and app ecosystems, oversight may be different from conventional warrants tied to location tracking.
De-anonymization risk: Even when identifiers are marketed as not directly revealing identity, persistent identifiers can enable tracking of individuals’ movements and inferred attributes.
Purpose limitation and data protection compliance: If location and behavioral signals are collected for advertising purposes, using them for surveillance can create legal and ethical questions related to data processing principles, including those embedded in frameworks such as the GDPR.
Transparency challenges: Beneficiaries of intelligence derived from ad ecosystems may have limited public explanations about data sources, retention, and usage constraints.

Industry Response and Dispute Over Findings

Penlink, described as the successor seller of the technology, is characterized as disputing the conclusions attributed to the analysis. In the referenced summary, Penlink’s position includes claims that findings were based on inaccurate information or a misunderstanding, and that the company operates in ways it believes comply with relevant legal requirements for the jurisdictions involved.

Broader Implications for Commercial Geolocation Surveillance

The Webloc reporting illustrates a wider trend: the convergence of commercial data broker practices and law enforcement intelligence workflows. When location inferences can be built from advertising-adjacent data streams, surveillance may be expanded without relying exclusively on technologies that clearly fall within traditional location-tracking categories.

These developments raise questions that extend beyond any single supplier:

How should legality and proportionality be assessed for ad-derived geolocation intelligence?
What retention periods and access controls should apply to location-linked datasets?
What transparency and accountability should be required from vendors and agencies purchasing such systems?
How can misuse or overcollection be detected and prevented?

Conclusion

Based on the referenced investigative summary, Webloc represents a high-capacity geolocation surveillance approach built on advertising intelligence inputs. The reporting describes large-scale device tracking, support for historical queries, and the ability to infer meaningful location patterns. With multiple organizations named across different countries, the system’s use has drawn scrutiny over privacy safeguards, oversight mechanisms, and the practice of converting advertising-derived signals into actionable intelligence for enforcement and investigative purposes.