A weather or gaming app that requests location access may feed data into a commercial pipeline that eventually reaches secretly tracking users law enforcement. That pathway is documented, though not every app or every forecast request necessarily results in a police record.
When an app requests location access, an embedded advertising software-development kit can transmit that data to advertising partners. Data brokers then aggregate those records and resell them to commercial intelligence companies, including Penlink, which sells a surveillance product called Webloc, according to Bloomberg and Citizen Lab.
What Investigators Can Do With It
Webloc turns a commercial location database into an investigative tool, according to Bloomberg’s reporting.
Webloc reportedly lets investigators select a specific place and time and identify which devices were present there. Bloomberg reported that investigators can then reconstruct where those devices traveled before and after that moment, without necessarily obtaining a carrier subpoena or court order for each query.
The Scale of the System
The volume of records involved extends well beyond any single city or agency.
Citizen Lab’s analysis of Penlink materials describes access to a continuously updated stream of records from up to 500 million mobile devices globally. Those records reportedly include device identifiers, coordinates, and profile data harvested from apps and digital advertising. Bloomberg reported the system can analyze billions of location points and rebuild a phone’s movement history over an extended period.
A Nameless Device Isn’t an Anonymous One
An advertising identifier carries no name, but persistent location patterns can resolve into a detailed portrait of a person’s life.
A week of precise location records can expose home addresses, workplaces, medical visits, religious attendance, and personal relationships, even when no name is attached to the device. Bloomberg reported that Tucson, Arizona, police used Webloc in investigations, including tracing a suspect to a specific apartment block.
The Consent Gap
Penlink defends its data practices, but privacy researchers question whether app consent extends to government surveillance.
Penlink told Citizen Lab that its data providers obtain user consent through app SDKs and filter sensitive locations in accordance with applicable requirements. Privacy researchers and civil-liberties advocates argue that consenting to share location data with a weather app is not the same as consenting to government surveillance.
A Contract Canceled, a Question Left Open
One federal agency stepped back, but the broader legal question about purchasing location data remains unsettled.
The Bureau of Alcohol, Tobacco, Firearms and Explosives canceled its Webloc contract in June after lawmakers questioned the use of commercially obtained location data, Bloomberg reported. The unresolved policy question is whether purchasing location records from a commercial broker should require the same judicial oversight as a warrant.
What You Can Do Now
Adjusting a few settings can limit how much location data leaves a device going forward.
On iPhone, open Settings, then Privacy and Security, then Location Services. Set unnecessary apps to Never or While Using the App, and disable Precise Location for any app that only needs an approximate area.
To limit cross-app tracking on iPhone, open Settings, then Privacy and Security, then Tracking. Turning off app tracking requests there reduces, but does not eliminate, all location collection and data sharing.
On Android, open Settings, then Location, then App location permissions. Choose Don’t Allow or Allow Only While Using the App for anything that does not genuinely need your coordinates.
On Android, search Settings for Delete Advertising ID to remove an identifier that may facilitate advertising-related linkage across apps. Exact menu paths vary by Android version and device manufacturer.
One honest caveat applies to all of these steps: they limit future collection. They do not erase location records already held by a broker, an advertiser, or a government customer. To stay safe, review your device settings regularly as app permissions can reset after updates.
