/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

days · browse · Enter similar · o open

An investigation details Webloc, an ad-based geo surveillance system providing access to a constantly updated stream of records from up to 500M mobile devices

Location data collected from mobile apps and digital advertising can reveal habits, interests and almost any other aspect of someone's life.

The Citizen Lab

Context & Ripple Effects

Webloc extends a long-running pattern in which app-derived advertising signals can be repurposed into surveillance products. Earlier reporting described surveillance vendors drawing location signals from ad-exchange systems, while investigations of the location-data trade documented collectors, aggregators, and marketplaces monetizing movement data across a multi-layered supply chain.

The significance is the claimed scale and continuous nature of the feed: it puts the ad-tech collection path back at the center of the privacy and security debate, rather than treating location exposure as an isolated app-permission problem.

First-order effects

  • The investigation gives privacy advocates, regulators, and platform-policy teams a concrete alleged example of advertising-derived location records being assembled into an always-updated surveillance service.
  • Webloc and the data suppliers or intermediaries behind such a feed face immediate reputational and compliance scrutiny, while people whose app data enters the advertising ecosystem face renewed exposure risk.

Second-order effects

  • Ad-tech participants may face pressure to audit downstream buyers and brokers, because prior reporting connected ad-exchange access to location-data extraction rather than solely to ad targeting.
  • Competing location-intelligence and surveillance vendors will likely face harder questions about provenance and controls, especially after scrutiny of a warrantless global phone-tracking tool made commercial location access more visible.

Third-order effects

  • If repeated investigations continue to show that advertising data can be converted into live tracking products, the distinction between ad measurement and surveillance will become less sustainable as a governance boundary.
  • The likely structural direction is toward tighter contractual and policy controls on location-signal resale; whether that meaningfully reduces exposure depends on enforcement across brokers and intermediaries, not only on app-level disclosures.

The trend: Commercial ad-tech data is increasingly being treated as surveillance-capable infrastructure, pushing scrutiny from individual apps toward the full location-data supply chain.

Discussion

  • @jsrailton John Scott-Railton on x
    @penlink ... 11/ Help starve the ADINT dragnet. Do this now: iPhone: ⚙️Settings➡️Privacy & Security➡️ Tracking Turn off “Allow Apps to Request to Track” Android: ⚙️Settings➡️Privacy ➡️ Ads ➡️Delete Advertising ID It's only a beginning, but you don't owe any of these companies a d…
  • @jsrailton John Scott-Railton on x
    BREAKING: You checked the weather this morning. And you just told a surveillance company where you sleep. Meet #Webloc, used by ICE, cops & foreign govs to track 500m+ phones. No warrant required. Our latest @citizenlab investigation + how to protect yourself 🧵/1 [image]
  • @citizenlab @citizenlab on x
    NEW REPORT: “Uncovering Webloc: An Analysis of Penlink's Ad-based Geolocation Surveillance Tech” Our research confirms that ad-based surveillance tech Webloc is used by military, intelligence, and law enforcement agencies across the globe. https://citizenlab.ca/...
  • @jsrailton John Scott-Railton on bluesky
    6/ You're 🇪🇺European?  Protected by #GDPR, right?  —  It may be a paper wall.  —  We sent 96 FOI requests & got some dubious answers.  —  Meanwhile our collaborator @szabolcspanyi.bsky.social found multiple intel agencies in 🇭🇺#Hungary using Cobweb products. …
  • @digitalwarrior @digitalwarrior on bluesky
    2/ What's new is not just the tech, but the pipeline: everyday commercial data becomes “investigative” location intelligence.  The report lays out how geofencing, route mapping, and association-by-co-location can be built from this ecosystem: citizenlab.ca/research/ana...
  • @rondeibert Ron Deibert on bluesky
    “This represents the first confirmation of the use of ad-based surveillance technology in Europe.”  - Uncovering Webloc: An Analysis of Penlink's Ad-based Geolocation Surveillance Tech citizenlab.ca/research/ana...
  • @campuscodi.risky.biz Catalin Cimpanu on bluesky
    “Intelligence agencies of Viktor Orbán's government have been secretly using Webloc — a mass surveillance tool that tracks hundreds of millions of people via smartphone advertising data — making Hungary the first confirmed EU country to deploy it”  —  vsquare.org/orban-spying...