Webloc: Analysis of Penlink's Ad-Based Geolocation Surveillance Tech

Key Findings

• Webloc is a global geolocation surveillance system that monitors hundreds of millions of people based on data purchased from consumer apps and digital advertising. It was developed by Cobwebs Technologies and is now sold by its successor Penlink.
• In collaboration with the European investigative journalism platform VSquare, we reveal that Hungarian domestic intelligence has been using Webloc since at least 2022 and continues to use it as of today. Webloc customers also include the national police in El Salvador.
• U.S. customers include ICE, the U.S. military, Texas Department of Public Safety, DHS West Virginia, NYC district attorneys, and several police departments in Los Angeles, Dallas, Baltimore, Tucson, Durham and in smaller cities and counties like City of Elk Grove and Pinal County.
• Based on the responses to 96 freedom of information requests we conclude that governments in Europe and the U.K. are highly nontransparent about their potential use of ad-based surveillance.
• Cobwebs Technologies has links to the spyware vendor Quadream through Cobwebs Technologies founder Omri Timianker, who now oversees the international operations of Penlink.
• Webloc is sold as an add-on product to the social media and web intelligence system Tangles. Based on technical analysis and other sources we show that Tangles and other products developed by Cobwebs Technologies are used in many countries across the globe.
• We briefly investigate another Cobwebs product named Trapdoor that appears to help trick victims into revealing information. Our analysis leads us to believe that Trapdoor can help facilitate the deployment of malware on devices.

Introduction

Targeted and mass surveillance based on everyday consumer data from mobile apps and digital advertising has been referred to as advertising intelligence (ADINT). We refer to it as “ad-based surveillance technologies.” These technologies have proliferated alongside the personal data surveillance economy. They are poorly regulated and often sold by firms that operate without transparency, raising serious security, privacy, and civil liberties concerns – especially when used by authoritarian governments that lack proper oversight.

In this report, we investigate, summarize and document what we know about the ad-based geolocation surveillance system Webloc. Developed by Cobwebs Technologies, Webloc is now sold by Penlink, after the companies merged in 2023.

Webloc has recently sparked significant public debate as the U.S. Immigration and Customs Enforcement (ICE) entered into a contract which allows it to access data on hundreds of millions of people for surveillance purposes. In March 2026, 72 senators and representatives in the U.S. Congress called for an investigation into “warrantless purchases of Americans’ location data” by ICE and other U.S. agencies.

Based on documents related to contracts and other sources, we analyze in detail the capabilities provided by Webloc, which is sold as an add-on product to the widely used social media and web intelligence system Tangles. According to the documents we have seen, Webloc provides access to a constantly updated stream of records from up to 500 million mobile devices across the globe that contain device identifiers, location coordinates, and profile data harvested from mobile apps and digital advertising. Customers can monitor the location, movements, and personal characteristics of entire populations up to three years in the past. As discussed in Section 3, our analysis of Webloc’s capabilities is based on a number of documents from 2021, 2022, 2023, and 2025.

Our research shows that intrusive and legally questionable ad-based surveillance (i.e. without a warrant or adequate oversight) is being used by military, intelligence, and law enforcement agencies down to local police units in several countries across the globe.