Weather, Game and Prayer Apps Feed Penlink's Webloc, a Phone-Tracking Tool Used by ICE and Police

A weather app asks for your location. A prayer app does too. Somewhere down the chain, that data can end up on a map in front of a police detective.

That is the pipeline described in a Bloomberg investigation by Ryan Gallagher, who walked through it on Bloomberg This Weekend on Nov. 8. The product at the center of it is Webloc, a surveillance tool sold by U.S.-based Penlink.

How the data gets from your phone to a police map

According to company documents Bloomberg reviewed, Webloc can monitor hundreds of millions of phones worldwide. It can log up to 70,000 locations a single device visited over the past 12 months.

The raw material comes from third-party tracking software embedded in weather, game, email and religious apps. Developers add that code to earn advertising revenue or monetize user data. It follows each phone through the advertising ID assigned to the device.

Data brokers aggregate those records and resell them. Citizen Lab's analysis of Penlink materials describes a continuously updated stream of records from up to 500 million mobile devices globally, including device identifiers, coordinates and profile data.

The system sometimes also draws on Wi-Fi signals and cell towers, not just GPS. Investigators can pick a place and a time, see which phones were there, and then trace where those phones went before and after. Bloomberg reported the data can be refreshed hourly, which lets movements be followed in near real time.

An advertising ID carries no name. But a week of precise location pings can reveal a home address, a workplace, medical visits and religious attendance, even with no name attached.

Who is using it

Webloc's U.S. customers include Immigration and Customs Enforcement, at least two military units and dozens of police departments, according to Bloomberg's reporting. By Bloomberg's tally of records, ICE spent about $9 million between 2022 and 2026 under contracts with Penlink and Cobwebs.

Police in Tucson, Arizona, used Webloc in investigations, including tracing a suspect to a specific apartment block, Bloomberg reported. Authorities in the United Kingdom, Saudi Arabia, Singapore, Germany, the Netherlands and the United Arab Emirates also use the technology.

The Bureau of Alcohol, Tobacco, Firearms and Explosives canceled its Webloc contract in June after lawmakers questioned its use of commercially obtained location data, Bloomberg reported.

The warrant question

In 2018, the U.S. Supreme Court ruled that law enforcement needs a warrant to get location data from telecommunications companies. The Justice Department argues that requirement does not apply to data purchased from commercial sources.

The Fourth Amendment limits what government can compel a carrier to hand over. The government's position is that it can simply buy comparable records on the open market.

Bloomberg reported that investigators can run Webloc queries without necessarily getting a carrier subpoena or court order for each one.

Nathan Freed Wessler of the American Civil Liberties Union said the expanding use of such tools raises serious concerns.

What Penlink says

Penlink has defended its practices. The company told Citizen Lab that its data providers obtain user consent through app software kits and filter sensitive locations in line with applicable requirements.

Privacy researchers and civil-liberties advocates dispute that consent to share location with a weather app amounts to consent to government surveillance. Those advocates are calling for greater privacy protections and oversight.

There is also a plain law-enforcement case for the tool. The Tucson example, tracking a suspect to a building, is the kind of lead detectives have always wanted. Not every app or every forecast request necessarily produces a record in a police database, and the pathway does not mean every user is being individually watched.

What is still open

The contract numbers and customer list are specific. The legal answer is not. The ATF's cancellation shows that congressional questions can change a contract, but it did not settle whether buying location records from a broker should require the same judicial sign-off as a warrant.

That question sits with Congress and the courts. Until one of them answers it, agencies that already hold Webloc contracts, including ICE, can keep using data bought from commercial sources without a warrant.