10.04.2026
4 min
167
Law enforcement and intelligence agencies in various countries have used Webloc to mass-track people through mobile app advertising data. Researchers estimate that the system has access to information on up to 500 million devices worldwide.
Hungarian domestic intelligence, El Salvadoran police, and a number of American law enforcement agencies are suspected of using Webloc, a global tracking system based on mobile advertising data. It is a tool that allows people to track their movements without direct access to their phones.
According to the Citizen Lab study, Webloc was created by the Israeli company Cobwebs Technologies. After merging with Penlink in July 2023, the product was transferred to this company, which has long worked with law enforcement agencies and specializes in collecting and analyzing digital evidence.
Among the users of the system in the United States are Immigration and Customs Enforcement, military units, state security departments, the New York State Attorney’s Office, as well as the police of large cities, including Los Angeles, Dallas, Baltimore, and Tucson. In addition, the tool is also used at the local level in smaller cities and counties.
Webloc itself works as an addition to the Tangles analytics platform. It accesses a stream of data from approximately 500 million mobile devices worldwide. These records contain device identifiers, coordinates, and profile information collected by mobile apps and advertising networks.
Essentially, the system uses purchased or collected advertising data to analyze people’s behavior. It allows you to track movements, determine places of residence and work, and build detailed routes for a period of up to three years. Separately, it is noted that Webloc can determine location by IP addresses and try to identify specific individuals.
Cobwebs Technologies has previously come under the attention of major platforms. In 2021, Meta blocked accounts associated with it, accusing the company of conducting target reconnaissance and using social engineering. According to the company, Cobwebs’ clients operated in various countries, including the United States, Saudi Arabia, Poland, and Hong Kong, and in some cases, activists and opposition politicians were targeted.
Journalistic investigations also show that Webloc can be used without a court order. One of the procurement documents explicitly states the possibility of continuous monitoring of advertising identifiers, IP addresses, and interconnected devices.
The researchers paid special attention to Cobwebs’ connections to the spyware market. In particular, the company is linked to Quadream through its founder Omri Timianker, who is currently responsible for international operations at Penlink. It is believed that Cobwebs itself ceased operations in 2023.
At least 219 active servers associated with the company’s products were also discovered. Most of them are located in the United States, the Netherlands, Singapore, Germany, Hong Kong, and the United Kingdom. Part of the infrastructure was also recorded in countries in Africa, Asia and Europe.
Penlink responded by saying that the researchers’ conclusions may be based on inaccurate information or a misunderstanding of the company’s operating principles. They emphasized that after the acquisition of Cobwebs, their practices had changed, and their activities were in compliance with US privacy laws.
At the same time, Citizen Lab emphasizes that such systems demonstrate how advertising data is transformed into a tool for mass surveillance. And the problem is that such technologies are already used not only by special services, but also at the level of ordinary police units in different countries of the world.
