The 'Free' App Trap: How Ad-Tech Became a Warrantless Police Surveillance Engine

Let's stop pretending the 'ad-supported' model is a benevolent trade-off for free services. For years, we've been told that giving up our location data to a few apps is the price of admission for digital convenience. In reality, as Bloomberg News first reported, it is a backdoor for warrantless government surveillance.

According to reporting from Bloomberg News, a digital intelligence company called Penlink is selling a flagship technology known as Webloc to law enforcement agencies in the U.S., the U.K., and worldwide. The system doesn't rely on traditional telecom intercepts; instead, it harvests vast quantities of location data from commonly used email, gaming, weather, and religious apps.

***

**OPINION: The Death of the Warrant**

As a consumer advocate, I find the legal gymnastics here abhorrent. In 2018, the Supreme Court ruled that police need a warrant to get location data from telecom companies. However, Bloomberg reports that the Justice Department has since argued this doesn't apply to data purchased from commercial sources.

This is a loophole of catastrophic proportions. By simply buying the data that 'free' apps collect for advertising, agencies like U.S. Immigration and Customs Enforcement, more than a dozen American police forces, and at least two branches of the U.S. military can track citizens without any judicial authorization. We are essentially paying for our 'free' apps with our constitutional rights.

***

**The Global Reach of Webloc**

Bloomberg's investigation reveals the staggering scale of this operation. The Webloc system, which originated at the Israeli startup Cobwebs, is capable of tracking hundreds of millions of mobile devices across the globe. In presentations given last year, Penlink demonstrated the tool's ability to track individuals in real-time as they moved through New York City's Fifth Avenue, the U.K. Parliament in London, and the European Central Bank in Frankfurt.

Beyond the U.S. and U.K., sales records and sources familiar with the company indicate that authorities in Singapore, Saudi Arabia, the United Arab Emirates, Germany, Austria, Hungary, and the Netherlands have acquired the technology.

**A History of Deception**

The origins of this tech are as murky as the legal framework supporting it. Bloomberg notes that Cobwebs was founded in 2015 by three Israeli special forces veterans for counterterrorism purposes. The company's history is marred by controversy; in 2021, Meta Platforms Inc. banned roughly 200 Cobwebs accounts for tricking people into revealing personal info, specifically targeting government officials and activists in Mexico and Hong Kong.

While Cobwebs stopped selling a product called Trapdoor following the Meta report, it pivoted toward Webloc and Tangles—a tool for monitoring social media connections. In 2023, the New York private equity firm Spire Capital acquired Cobwebs in a $200 million deal, merging it with Penlink. Under CEO Peter Weber, a Spire Capital operating partner, Penlink has aggressively expanded Webloc's reach to include private security firms and local police departments.

**The Human Cost**

Nathan Freed Wessler, deputy director with the ACLU’s Speech, Privacy, and Technology Project, told Bloomberg that the lack of legal oversight has led to a "ridiculous expansion" of these tools. He warned that this allows the government to investigate people they have "no business investigating."

Penlink has declined to name specific customers, stating only that Webloc supports national safety and law enforcement efforts and that they comply with applicable laws. But when the 'law' allows the government to buy its way around a warrant, the law is no longer protecting the citizen—it's protecting the surveillance state.