Webloc Lets Police Track Phones Through the Ads in Weather Apps and Games

Police bought a tool that shows where up to 500 million phones have been over 12 months, without a warrant. The location came out of the ads in weather apps, games and a prayer app. Up to 500 million phones sit in the tool they bought, on sale since 2020.

In 2025, a US firm prepared presentations for police forces in several countries to show what its tracking tool, Webloc, could do. On the screen, it followed people’s phones as they walked down Fifth Avenue in New York, visited the European Central Bank in Frankfurt and came close to the UK Parliament in London. Bloomberg News got hold of those presentations, along with training material and internal documents.

The seller is Penlink, which has made software for American police for decades, mostly to analyze tapped phone calls and internet data gathered during investigations. Webloc comes from Israel. It was built by Cobwebs Technologies, set up in 2015 by three veterans of Israeli special forces, who designed it for counterterrorism. In 2023 both ended up under the same US investment firm, and the sale of Webloc moved to the American side. A license starts at around 100,000 dollars a year.

In April, researchers at Citizen Lab, at the University of Toronto, mapped out what that money buys. They worked from contracts, procurement records and leaked documents, and describe access to records from up to 500 million mobile devices across the globe. In the documents the reporters saw, Webloc shows where a phone has been over the past 12 months, refreshed once an hour. One older US contract mentions three years.

An officer opens a map, draws a shape around a street or a building, and picks a time window. Webloc then lists the phones that were inside. It can show which phones turned up in two different places within the same window. It sends an alert when a phone shows up somewhere new, and it shows where a phone spends its nights and where it spends its days.

That last part is how police get from a phone to a name. A 2021 sales proposal for a police force in Central America puts it plainly: work out who is behind the device, find the home and the workplace, and send officers to the suspect.

To follow a phone, Webloc first has to recognize it, and for that it uses the advertising ID. Your phone has a number made for ads, on Android and on the iPhone. Apps read it so that advertisers can recognize the same phone across different apps and show it ads that fit. On an iPhone, an app has to ask your permission first.

The ad industry calls that number anonymous, because it carries no name and no phone number. A number that shows up at the same address night after night, and at the same office in the morning, still points to one person.

The researchers published what a single Webloc record could hold, as of 2021:

• → the advertising ID and the IP address
• → the time, plus GPS coordinates or a location worked out from nearby WiFi
• → the name of the WiFi network the phone was connected to
• → the brand, model and operating system of the phone
• → an estimated home, workplace and most visited places
• → age, gender, and labels such as parent, traveler or gamer
• → the apps on the phone, with when each was first and last seen

Webloc’s makers say it now only holds locations tied to a device ID, with no age, gender or interests. The researchers had no way to check that.

A location can reach Webloc in two ways, and the researchers could not say for sure which one it uses today.

The first way runs through the app itself. A developer building a free app often adds ready-made code from an outside firm to show ads or to count users. That code is called an SDK, a software development kit, and it runs inside the app. Allow your weather app to see your location, and the code inside it can read that location too and pass it on to whoever wrote it.

One of those code makers is Start.io. According to the documents, its SDK sits in more than 500,000 apps with more than 25 billion downloads between them, and it claims to reach 2.4 billion devices, 300 million of them in the US. A platform that checks Android apps for trackers found one linked to it in more than 4,400 apps.

Some of the location data in Webloc came from there, according to the documents and former employees. Webloc’s makers deny buying it and say the Israeli developers only ran a trial with that data before the takeover. The SDK maker answers that its contracts limit the data to advertising, that most of it is not precise, and that the download figures are theoretical.

The second way needs no code inside the app at all. When an app has room for an ad, it sends out a request, and advertisers bid on it within a fraction of a second. That request can carry the advertising ID and the location of the phone, and those taking part in the auction get to see it. The stream of data from those auctions is called the bidstream. A data broker that joins in can collect locations from apps it never made a deal with.

That is why app makers often have no idea where their users’ locations end up. Webloc’s makers say their partners collect through their own SDK deals and get consent through the apps, but those partners do not hand over a full list of which apps. The seller itself is listed in California’s register of data brokers, and its own privacy policy says it may get a device’s past locations from other brokers.

One detail in the 2021 records points to the first way. They show the names of WiFi networks, and those names cannot travel through the ad auction, only through code inside an app. So back then, at least part of the data came out of the apps.

The documents do name apps: weather apps on Android and iOS such as AccuWeather, the prayer app Muslim Pro, downloaded more than 100 million times on Google Play, and the game Multi Maze 3D. All three deny any deal with the seller. The documents show where the data came from. They do not show who handed it over, and with a chain this hidden, the app makers may not know either.

The prayer app has been here before. In 2020, reporters found it was sending precise location data to a broker, and that broker confirmed to a US senator that it sold data from US phones to US military customers through defense contractors. The app called the report incorrect and cut its ties with its data partners. In January 2025, hackers stole files from another location broker, Gravy Analytics, including a list of thousands of apps its data came from. The prayer app was on that list too, and said it does not allow the ad networks it works with to collect location.

Police can buy this because of a gap in the law. In 2018, the US Supreme Court ruled that police need a warrant from a judge to get someone’s location history from a phone company. Since then, the Justice Department has argued that this rule does not cover location data that police buy on the open market. Asking a phone company needs a judge. Buying the same kind of data from a broker, in that reading, does not. So in most of the US, Webloc is used without a warrant.

In June 2026, the court went a step further. It ruled in a new case that getting someone’s location history from Google counts as a search, because people can reasonably expect the location of their phone to stay private. The ruling says nothing about buying data from brokers. Some privacy lawyers say those purchases now stand on weaker ground, while a former official of that same department writes that the ruling leaves them untouched.

Who uses it:

• → US Immigration and Customs Enforcement spent around 9 million dollars on four contracts between 2022 and 2026, which included Webloc licenses, according to US procurement records
• → at least two branches of the US military
• → more than a dozen US police forces, including Dallas and Baltimore
• → the Los Angeles police, who ran 136 searches in 2022 and 1,319 in 2023 in Webloc and its sister tool Tangles combined
• → Hungary’s domestic intelligence, since at least 2022, which the researchers call the first confirmed use of this kind of ad-based tracking in Europe
• → the national police of El Salvador, who bought it together with two other tools from the same maker through a Mexican reseller, and used it in 2021

Sales records and insiders show that Webloc has also gone to London’s Metropolitan Police and to authorities in Saudi Arabia, Singapore, Mexico, Israel, the United Arab Emirates, the Netherlands and Germany.

The police in Tucson signed a contract with Webloc’s makers, paid with border security money meant for sex trafficking investigations. In September 2023, an internal police report described how they used Webloc in a case of thefts and burglaries, and found the apartment of the suspect and his partner. The police say their license has since expired.

The ATF, the US agency for firearms and explosives, ran more than 340 searches in Webloc without a warrant, according to two members of the US Congress. More than 222 of them were tied to active cases. In a suspected arson at a defense contractor, a prosecutor and a judge were uneasy about using this kind of ad data, and the agency asked a court for phone tower records instead. After the two lawmakers started asking questions, the agency cancelled the contract in June and said the tool did not meet its needs.

In training sessions, the seller’s staff showed police how to follow people at pro-Palestinian demonstrations, suspected Iranian spies, Serbian militia groups and members of motorcycle gangs such as the Hells Angels, according to the documents. The seller’s answer is that the agencies ask for those examples themselves, and that using an example in a training is not the same as approving of it.

Webloc only goes to law enforcement and public safety agencies, and in rare cases to government contractors working for them, according to the seller and the investment firm behind it. The investors say it has helped find missing children, bank robbery suspects and trafficking networks. The seller says its data partners get consent and leave out hospitals, schools and places of worship.

That consent usually sits in the app’s terms. Those terms often say the developer may share location data with third parties. They do not say that a third party may sell it on to a police tool.

To the Toronto researchers, the seller replied that their findings rest on wrong information or a misunderstanding, and describe products that no longer exist. Which products, it did not say.

The documents also describe Safeloc, a version of Webloc meant for banks and retailers, for fraud checks and credit risk. The seller says no such product is on offer and that the material was probably made to test the idea. A security consultant working for the wine and spirits arm of LVMH showed how Webloc could help investigate thefts at a warehouse in western France, French reporters revealed this summer. The consultant says the luxury group chose not to use it, and the investors behind Webloc say they never sold it to the group.

In 2025, Montana became the first US state to ban its own police from buying location data on the open market without a warrant or a subpoena from a court.

In January 2025, the FTC, the US agency that protects consumers, banned the broker whose files had leaked that month, and its subsidiary, from selling sensitive location data. According to the agency, the two claimed to process more than 17 billion signals from around a billion mobile devices a day. The ban has an exception for national security and law enforcement.

A federal bill to close this gap passed the US House of Representatives in 2024, but never got a vote in the Senate. The same idea is now in a new surveillance reform bill, which has not come to a vote either.

What you can do on your own phone:

• → On an iPhone, go to Settings, Privacy & Security, Tracking, and switch off Allow Apps to Request to Track
• → On Android 12 or newer, go to Settings, Privacy, Ads, and tap Delete advertising ID
• → Go through the location permission of each app, and give it only while using the app, or not at all
• → Remove free apps you no longer use

These steps cut down the sharing, but they do not close it. Google’s own rules for app developers allow an app to fall back on its own identifier when the advertising ID is gone.

Want to see which servers a free app contacts? Run Android in VirtualBox, open the app, and watch its traffic in Wireshark. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Citizen Lab, Uncovering Webloc | US Supreme Court, Chatrie v. United States | FTC, order against Gravy Analytics and Venntel