Police Can Track Hundreds of Millions of Phones Through Ad Data—No Warrant Needed

Ads in Popular Apps Give Police a Powerful Tool to Spy on Users

Penlink's Webloc, built by Israeli firm Cobwebs, pulls location data from ordinary weather, gaming, email, and religious apps to map where phones have been over the past year, refreshed hourly. US Immigration and Customs Enforcement, at least two military branches, and more than a dozen police forces use it, along with agencies in the UK, Saudi Arabia, Germany, and elsewhere. Licenses start around $100,000 a year. The ACLU warns of investigations into people the government has no business investigating.

This is a powerful mass surveillance tool that's trickling down from military and intelligence agencies to federal law enforcement and then to state and local police.
  1. delichon

    Google appears to be overlooking their explicit ban on this.

    If your app handles personal and sensitive user data, then you must ... Not sell personal and sensitive user data.

    The rule also applies to third-party code.

    If you include third party code (for example, an SDK) in your app, you must ensure that the third party code used in your app, and that third party's practices with respect to user data from your app, are compliant with Google Play Developer Program policies... For example, you must ensure that your SDK providers do not sell personal and sensitive user data from your app.

    https://support.google.com/googleplay/android-developer/answ...

    Isn't this abuse what we are supposed to be paying their 15% Play Store tax to stop?

  2. everdrive

    There's no good reason to use your phone for any more than the bare minimum. Remove as many apps as possible. Treat it like a landline by just keeping in on a desk or something when you're at home.

  3. jareklupinski

    > The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps.

    is there a list

  4. moscoe

    This is why network-wide dns ad-blocking is necessary.

    Setup a personal ad-blocking vps/vpn to route traffic through when away from home: https://trailofbits.github.io/algo/

  5. hoppp

    Code your own apps, run your own things.

More from this day

2026-11-08