The ATF’s now-cancelled Webloc contract used ad-tech location data to run warrantless phone searches tied to active criminal investigations. There is a creepy moment many smartphone users recognize: mention running shoes once and Instagram fills with Nike ads thirty seconds later. That ad-tracking ecosystem — the one harvesting your location through weather apps and mobile games — reportedly had a second customer you never signed up for. The ATF used Penlink’s Webloc tool to run more than 300 warrantless location searches, with over 200 tied to active criminal cases, according to Sen. Ron Wyden and Rep. Michael Cloud. After both lawmakers pressed the agency, ATF cancelled the contract and called it a “pilot” that “does not meet our needs.” Three hundred searches is a lot of piloting.
How Your Ad Data Becomes a Federal Search Tool
Webloc harvests the same location pings that power targeted ads — and turns them into near-real-time surveillance without a warrant.
The mechanics are straightforward and unsettling:
- Webloc pulls geolocation data from consumer apps and advertising networks — the same pipeline feeding you targeted ads across social media.
- Per Citizen Lab research, the tool can infer your home address, your workplace, and your daily patterns using historical and near-real-time tracking.
- In one suspected arson case involving a U.S. defense contractor, both a prosecutor and a judge objected to the Webloc data. ATF ultimately obtained a traditional court order for cell tower records instead.
- The legal gap here exists not by design but by omission. The Supreme Court’s 2018 Carpenter decision required warrants for carrier-held location records. Commercially purchased geolocation data? The court has not directly addressed it.
Sen. Ron Wyden called the cancellation “a victory for Americans’ constitutional rights.”
One Agency Down. The Rest Are Still Shopping.
The FBI and DHS continue buying commercial location data, and legislation to require judicial oversight before such purchases remains uncertain.
ATF walking away changes nothing structurally. The FBI and Department of Homeland Security reportedly continue purchasing commercial geolocation data. ICE and local police agencies have also used Webloc, per Citizen Lab research. Penlink said it is “proud” of its ATF relationship and that its tools use commercially available data to support criminal investigations — a framing that is technically accurate and deliberately narrow. Let the 300-plus searches provide the context.
Lawmakers have introduced legislation requiring judicial orders before agencies can purchase this data. Passage remains uncertain.
The contract is gone. The loophole that made it possible remains wide open, waiting for the next agency with a budget line and a loose reading of “commercially available.” Your phone is still broadcasting.
