Law Enforcement Agencies Across Multiple Countries Used Webloc for Global Device Tracking via Ad Data
Law enforcement agencies in Hungary, El Salvador, and the United States have utilized a global geolocation surveillance system called Webloc, which collects location data from advertising sources. Developed by Israeli company Cobwebs Technologies and now marketed by Penlink following a merger, the tool enables tracking of devices worldwide through ad-related geolocation intelligence.
What happened
Investigations have linked Hungarian domestic intelligence, El Salvador's national police, and various U.S. law enforcement and police departments to the use of Webloc, a surveillance system that leverages advertising data to determine the location of devices globally. Webloc was originally developed by Cobwebs Technologies, an Israeli company, and the product has been sold by Penlink since a merger between the two companies in July 2023.
This advertising-based tool allows law enforcement to gather geolocation information on approximately 500 million devices worldwide. Its use highlights the growing adoption of commercial surveillance technologies that exploit advertising data streams for investigative purposes.
Why it matters
The deployment of Webloc by law enforcement agencies across different countries underscores increasing reliance on commercial data sources for surveillance and location tracking. This method involves repurposing advertising data, which is abundant and commonly collected by various services, raising concerns about user privacy and the extent of oversight on such tools.
Understanding how law enforcement accesses and utilizes advertising-based geolocation data is critical, especially given the potential scope of surveillance on millions of devices globally. This case emphasizes the need for transparency and clear guidelines around the use of commercial data in public safety investigations.
What security teams should do
Security teams and privacy professionals should be aware of the evolving landscape where advertising data can be accessed and leveraged to track device locations. Reviewing exposure of device location through advertising networks and understanding third-party data sharing policies are prudent steps.
While direct mitigations against this tool are not detailed, organizations could monitor data flows related to advertising identifiers and assess potential privacy risks posed by location data aggregation. Awareness initiatives and user education regarding location data sharing settings may also help mitigate unintended exposure.
Key technical details
Webloc is a geopositioning surveillance system developed initially by Cobwebs Technologies, an Israeli firm specializing in data analytics and intelligence solutions. The product uniquely repurposes advertising data, which inherently includes device identifiers and location signals, to track geolocation globally.
Following a corporate consolidation in July 2023, Penlink, the successor company formed by merging Cobwebs Technologies, currently markets and sells Webloc. The tool reportedly enables tracking of approximately 500 million devices worldwide by correlating data points collected through advertising platforms, though detailed technical specifics about its data collection methodology or integration endpoints are not disclosed.
Affected organizations/products
The entities confirmed to have employed Webloc include Hungarian domestic intelligence, the national police force of El Salvador, and multiple U.S. law enforcement and police departments. The surveillance extends globally, leveraging advertising data from an estimated 500 million devices.
Source attribution
https://thehackernews.com/2026/04/citizen-lab-law-enforcement-used-webloc.html
