Security agencies in at least 12 countries used Penlink's Webloc ad-based surveillance system

An investigation found Penlink's Webloc, a tracking system built from advertising data, has been used by security agencies in at least 12 countries. The countries named include the United States, Austria, El Salvador, Hungary, the United Kingdom, Netherlands, Germany, Mexico, Singapore, Saudi Arabia, the United Arab Emirates and Israel. The system links advertising identifiers to location data, enabling investigators to trace devices through commercial ad networks.

The evidence comes from open-source research, freedom-of-information requests and server infrastructure mapping, methods used in Citizen Lab's April report and expanded by Bloomberg. The April report identified customers in the United States, El Salvador and Hungary; Austria's Interior Ministry was later confirmed as a customer. Bloomberg's reporting named customers in eight additional countries, producing a list that spans democracies, authoritarian states and jurisdictions where the system's lawfulness is contested.

Senior researcher Wolfie Christl described Webloc as a powerful mass surveillance tool moving from military and intelligence agencies to federal law enforcement and then to state and local police. The pattern shows commercial advertising infrastructure being repurposed for state tracking. Unlike traditional targeted surveillance, ad-based systems can sweep broad populations, then filter to devices or locations, making the tool useful for investigations and for monitoring crowds.

Webloc matters because it turns advertising identifiers into a surveillance asset, affecting anyone whose phone participates in the ad economy. Its use by security agencies in authoritarian states identified in the reporting is particularly dangerous, because mass surveillance can track individuals without individualized suspicion. In Europe and the United Kingdom, the lawfulness of such intrusive, disproportionate mass surveillance is highly controversial.