Government and police forces across the United States and around the world are using a commercial surveillance system that turns the ordinary ads embedded in weather, gaming, email, and religious apps into a powerful phone-tracking weapon — often without a search warrant. The tool, called Webloc, is sold by the Nebraska-based company Penlink (which acquired the Israeli startup Cobwebs that originally developed it). As detailed by Bloomberg News‘ Ryan Gallagher, the system can reconstruct the movements of hundreds of millions of phones worldwide, building detailed location histories going back 12 months and updating them on a near real-time basis.
Webloc works by harvesting vast quantities of location data that flow through advertising technology. Law enforcement users can draw a box on a map for a specific place and time and instantly see every phone that was present, analyzing what company documents describe as “billions of location data points.” Presentations prepared for international agencies demonstrated the system tracking people walking down Fifth Avenue in New York, visiting the European Central Bank in Frankfurt, and moving near the UK Parliament in London.
Ryan Gallagher for Bloomberg News:
Some location data previously harvested by the Webloc system was sourced from an Israeli company named Start.io, which works directly with app developers, offering them a chance to make money by embedding its SDKs inside their apps.
Start.io has placed SKs in more than 500,000 apps that have collectively been downloaded more than 25 billion times, according to company documents reviewed by Bloomberg, and former employees of Start, who declined to be identified in order to discuss sensitive company information. Start’s marketing materials boast that the company can reach 2.4 billion devices globally, including 300 million in the US alone.
In the United States the technology is used without judicial authorization, even though a 2018 Supreme Court decision requires warrants for location data obtained from telecom carriers. The Justice Department has argued that data purchased from commercial sources falls outside that requirement. Confirmed or reported users include U.S. Immigration and Customs Enforcement (which has spent millions on related contracts), branches of the U.S. military, and more than a dozen American police departments, among them agencies in Los Angeles, Dallas, Baltimore, and Tucson. Internationally it has been acquired by authorities in the United Kingdom, Saudi Arabia, the United Arab Emirates, Singapore, the Netherlands, Germany, Austria, and Hungary.
In Tucson, internal records obtained by the Electronic Frontier Foundation showed the department used Webloc to identify suspects in thefts and burglaries and in the abduction of a University of Arizona student; the agency later let its license expire. Company materials and training sessions have also illustrated the tool’s use against pro-Palestinian protesters, suspected Iranian spies, Serbian militia groups, and members of motorcycle gangs such as the Hell’s Angels. Penlink says the product is reserved for law enforcement and national-security purposes, that it does not supply U.S. location data to foreign governments, and that its data partners obtain user consent and filter sensitive locations.
Privacy advocates strongly disagree. Nathan Freed Wessler of the ACLU called the expansion “ridiculous” and warned that people “the government has no business investigating” will be swept up. Researchers at Citizen Lab described Webloc as a mass-surveillance capability that has trickled down from intelligence agencies to local police. App developers of products such as Accuweather, the Muslim Pro prayer app (downloaded more than 100 million times), and Multi Maze 3D told Bloomberg they have no relationship with Penlink and were unaware their data could end up in the system — underscoring the opaque supply chain of advertising SDKs and data brokers.
Some U.S. states have begun to restrict the practice, and federal legislation has been proposed, but the commercial marketplace for location data continues to grow. As digital-rights experts note, users almost never explicitly consent to having their everyday app activity turned into a government tracking feed, yet the data keeps flowing. The result is a private-public surveillance mesh that is increasingly difficult for courts or the public to oversee.
MacDailyNews Note: Users can reduce (though not fully eliminate) the risk of their phone location data being collected via advertising tech and sold or shared for tools like Webloc. The data typically comes from apps that have location permission and embed ad/analytics SDKs; many people never realize the full supply chain. Complete protection is difficult because of opaque third-party trackers and the sheer volume of data, but these steps meaningfully limit exposure.
Restrict location access
This is the highest-impact step. Apps only need precise or background location in limited cases (navigation, ride-hailing, fitness tracking). Weather, games, email, shopping, and most others do not.
• On iPhone: Go to Settings > Privacy & Security > Location Services. For each app, set it to “While Using the App,” “Ask Next Time,” or “Never.” Turn off “Precise Location” for any app that does not require exact coordinates (most weather and content apps work fine with approximate location). Also review System Services and disable unnecessary items such as Location-Based Ads.
• On Android: Go to Settings > Location > App location permissions (or Permission manager > Location). Prefer “Allow only while using the app,” “Ask every time,” or “Don’t allow.” Turn off precise location where available (Android 12+). Minimize apps set to “Allow all the time.”
Review permissions periodically, as apps can request them again after updates.
Disable or limit advertising identifiers
The advertising ID (IDFA on iOS, Advertising ID/GAID on Android) is a key that helps link location pings across apps and over time.
• On iPhone: Settings > Privacy & Security > Tracking > turn off “Allow Apps to Request to Track.” This prevents apps from accessing the IDFA. Also go to Privacy & Security > Apple Advertising and turn off Personalized Ads.
• On Android: Settings > Privacy (or Security & Privacy / Google > All services) > Ads > Delete advertising ID. Confirm. (Paths vary slightly by manufacturer; search “Ads” in Settings if needed.) After deletion, apps generally receive a string of zeros instead of a usable identifier. Prefer “Delete” over simply resetting if both options appear.
Audit and minimize apps
• Prefer apps with fewer or no ad SDKs. On Android, the free open-source Exodus Privacy app (or its website reports.exodus-privacy.eu.org) scans installed apps for known trackers and permissions and flags those with heavy advertising or location components.
• Uninstall apps you rarely use, especially free ones that monetize via ads. Check privacy labels or policies, though they are often incomplete.
• Be especially cautious with weather, gaming, religious, email, and similar “utility” apps that the Bloomberg reporting linked to data sources.
Additional practical steps
• Use browser privacy tools (e.g., Safari’s Prevent Cross-Site Tracking or extensions like Privacy Badger on desktop) and consider a Private DNS filter on Android (Settings > Network & Internet > Private DNS) with a tracker-blocking provider if you are comfortable configuring it.
• In your Google Account (or Apple ID), review location history, ad personalization, and data-sharing settings; turn off or auto-delete where possible.
• In jurisdictions with stronger rules (certain U.S. states, EU, etc.), exercise rights to opt out of data sales or request deletion from brokers. Coverage is incomplete and does not retroactively erase everything already collected.
• Keep the device OS updated; newer versions add more granular permission controls.
These measures reduce the volume and linkability of the location data that feeds commercial surveillance databases. They do not stop every possible collection method (cell-tower data, Wi-Fi/Bluetooth scanning in some cases, or other sensors), and determined actors with legal process can still obtain information through traditional channels. The most effective long-term protection remains limiting what you install and what permissions you grant, combined with broader regulatory pressure on the ad-tech and data-broker industry.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
Like 🙂 or dislike 🙁 this post below!
APPL isn’t w/o stink, but it appears to be the best OS in the dirty clothes hamper re: security/privacy.
Ironically, a Google Pixel loaded with GrapheneOS is much more fortified and, unless AAPL wants to separate itself from the rest, it may be a reasonable choice for security in the future.