ICE Is Tracking Your Neighborhood. It Bought the Data From an App on Your Phone.
A surveillance tool called Webloc lets federal agents draw a circle on a map and pull the location history of every phone inside it. No warrant required.
I read the Citizen Lab’s technical analysis last week, and I had to put my phone down for a second. Not because the finding was a surprise, exactly. But seeing it laid out this plainly, ICE drawing a circle on a map and pulling the movement history of every device inside it, no warrant, no judge, just a purchase order, still landed harder than I expected.
Here’s the part that should bother you: the data came from your weather app, navigation app, and the app that found you a parking spot. You didn’t hand this to a federal agent. You tapped “allow” on a permissions prompt in under a second, the way all of us do, and somewhere down the line, that tap collected your location data and revealed your habits, interests, and almost every other aspect of your life to federal agents.
In this report, I uncover how a geolocation surveillance system called Webloc uses ad-based data to monitor hundreds of millions of people worldwide, sourced from consumer apps and digital advertising.
THREE THINGS YOU NEED TO KNOW
ICE can surveil your block without a warrant, using data your apps already collected. Webloc lets agents draw a perimeter on a map, your neighborhood, your block, the parking lot outside your kid’s school, and pull the movement history of every phone that passed through it. The data comes from the commercial location market, the same advertising pipeline that powers retargeted ads, sourced from hundreds of millions of phones. ICE’s own internal legal analysis says none of this requires a warrant, because you “voluntarily” shared it with an app.
ICE reversed its own policy to buy this. Congress pressured ICE to stop purchasing commercial location data by 2023. They started again in September 2025, a no-bid contract worth up to $2.3 million for one year. The company they handed it to, Penlink, was banned from Meta for its predecessor’s clients targeting activists, opposition politicians, and government officials in Hong Kong and Mexico. Read that twice.
Congress already passed the fix. The Senate just hasn’t bothered. The Fourth Amendment Is Not For Sale Act would close this exact loophole, requiring a warrant before the government buys this kind of data. The House passed it in 2024. It’s been sitting in the Senate since. Until that changes, your location history is for sale to whichever federal agency has a budget for it.
“This is probably unconstitutional. Usually, if law enforcement wants to take your phone and is interested in getting your location data, they would need a warrant, but because the law has not kept up with technology, there is this loophole that effectively has allowed law enforcement to purchase location data, which is highly sensitive, without getting a warrant first.”
-Don Bell, Policy Counsel, Constitution Project at the Project on Government Oversight
The Contract
On April 9, 2026, the Citizen Lab at the University of Toronto published the technical breakdown that confirmed what 404 Media had already reported back in January: ICE’s Homeland Security Investigations unit had quietly signed a no-bid contract with Penlink, a Nebraska surveillance company, in September 2025. Two products: Webloc and Tangles. Up to $2.3 million, running through this September.
ICE called the tools “essential.” “An integral part” of its mission, in their words. In April 2026, DHS handed Penlink another $2.9 million on top of that. This isn’t a pilot program anymore. It’s a relationship.
A DHS spokesperson told Newsweek, “ICE does not purchase illegal information. ICE only utilizes tools it has legal authority to use.” I’ll let you weigh that against everything below.
How Webloc Works
I want to walk you through this slowly, because the mechanics are the whole story.
Webloc started life at Cobwebs Technologies, an Israeli surveillance firm that Penlink absorbed in a $200 million private equity deal in 2023. It pulls location data from mobile advertising identifiers, GPS, Wi-Fi signals, IP-based location data, and the exhaust fumes of basically every app on your phone. Citizen Lab’s research found Webloc customers extend well beyond ICE, including Hungarian intelligence and the national police of El Salvador.
An ICE agent opens a map. Draws a shape around an area, a neighborhood, a city block, or the address of a specific building. Webloc returns every device that passed through that shape during whatever time window the agent picked. Then it follows individual devices outward from there, inferring home addresses, workplaces, and the places you go often enough that a pattern emerges.
Penlink’s own marketing copy calls Webloc a “digital intelligence package for national security.” I’ll let that phrase sit there for a second.
Tangles, the Companion Piece
Tangles is the social half. It scrapes the open web and pulls data from social media APIs, stitching together someone’s post history, comments, keywords, location tags, photos, and connections. It can detect faces, identify people, gauge the sentiment of their posts, and flag an account for a watch list.
Run together, Webloc tells ICE where your phone has been. Tangles tells them who you are once they’ve found you there. That combination, an integrated location-plus-social package, is reportedly why ICE picked Penlink over competitors in the first place.
The Legal Theory
In Carpenter v. United States (2018), the Supreme Court said the government needs a warrant to get your cell-site location records from a phone carrier. Settled law. Should have closed this door.
Except the government found a side door: the commercial data broker market. NPR’s reporting on this loophole lays out the argument plainly: because location data collected by apps flows through advertising networks and gets sold by brokers, the government claims you “voluntarily” disclosed it to a third party, so you have no remaining expectation of privacy in it. What the government can’t legally seize, it can simply purchase.
One privacy advocate put it to NPR this way: nobody would accept police paying a landlord for a spare key as a substitute for a warrant to search a house. This is the digital version of that same move.
ICE’s own internal legal memo, obtained by 404 Media, applies exactly this logic to Webloc and concludes no warrant is needed. Civil liberties groups don’t buy it. The ACLU has said plainly that nobody carrying a phone consented to a permanent government record of everywhere they go. Don Bell’s quote above says the same thing in plainer terms: probably unconstitutional, and the law just hasn’t caught up to the technology yet.
Who Actually Built This
Cobwebs, the firm behind both tools, got banned from Meta in 2021 during a crackdown on surveillance-for-hire companies. Meta’s own investigation found Cobwebs clients had used the tools against activists, opposition politicians, and government officials in Hong Kong and Mexico. That’s the company whose technology now sits inside a U.S. federal contract.
In 2023, Spire Capital bought Penlink and merged it with Cobwebs, pairing Penlink’s telecom interception tools with Cobwebs’ location and social surveillance products, for $200 million. ICE had actually worked with Penlink once before, a smaller $2.4 million contract back in 2018 for telecom analysis software. This is an old relationship getting a lot bigger.
ICE has contracted with Penlink before. In 2018, the agency signed a $2.4 million contract for Penlink’s telecommunications analysis software.
Congress Noticed. Congress Has Done Nothing About It Yet.
72 Democratic members of Congress, led by Sen. Ron Wyden and Rep. Adriano Espaillat, sent the DHS Inspector General a letter in March 2026 asking for an investigation. Rep. Shontel Brown led a separate letter the month before, calling it “mass surveillance of entire communities or city blocks.” Wyden’s office had asked ICE for a briefing back in October 2025. ICE scheduled it for February. As of early March, they still hadn’t shown up.
The House passed the Fourth Amendment Is Not For Sale Act in April 2024. Two years ago. It would require a court order before the government buys this kind of data from brokers. The Senate hasn’t touched it.
This Isn’t Just an Immigration Story, and That’s the Point
Webloc doesn’t check citizenship before it maps a neighborhood. Every phone inside the perimeter gets swept up: the undocumented worker, sure, but also the citizen walking a dog, the journalist on assignment, the activist headed to a meeting, the patient walking into a clinic on that block.
The tool doesn’t know who you are. It only knows where your phone was.
That’s where Tangles makes it worse. Once a device gets flagged from a location sweep, Tangles can pull that person’s entire social footprint, photos, connections, keywords, whatever they’ve posted publicly. A citizen who happened to be standing in the wrong place at the wrong time can end up in a federal file built entirely from data they generated themselves, using apps that promised them nothing more sinister than convenience.
I keep coming back to this: the commercial data market doesn’t ask why you want the data. It asks whether you can pay. ICE can pay. So can any other agency that decides your neighborhood is worth watching.
The apps that collected this told you it was to improve your experience, serve better ads, and remember your preferences. All true. Also incomplete. The same data that found you a parking spot is now sitting in a marketplace, available in bulk, to any government agency willing to write a check and lean on a legal theory nobody who tapped “allow” ever agreed to.
You weren’t told this was possible. The permissions prompt didn’t mention it. I’d bet most of the engineers who built those prompts didn’t picture this either.
Why I Call This Coercive Capitalism
Coercive Capitalism is my shorthand for systems that don’t force compliance; they engineer it by widening the gap between what people think they’re agreeing to and what they’re actually giving up. This story is about as clean an example of that as I’ve come across.
The apps offered something real: navigation, weather, ride-sharing, and retail discounts. People said yes. The benefit wasn’t fake. A weather app that knows where you are gives you a better forecast. A navigation app that tracks your route saves you real time. These trades were genuine.
The cost was a location permission, tapped through in under a second, the way permissions prompts are designed to be tapped through. That’s the actual bargain people made. What the prompt never said was where the data would travel after that.
It didn’t stay with the app. It moved into the advertising ecosystem, where brokers packaged and resold it. ICE didn’t hack a single phone. It went shopping in a marketplace built for car dealerships and retailers, and found federal agencies welcome there too.
And here’s the piece that, to me, seals it: you can’t get your data back. You can’t claw it out of the broker pipeline once it’s in. The instant you tapped “allow,” it entered a system with no exit. Nobody who traded their location for a discount or a faster route home agreed to be surveilled by immigration enforcement. But the architecture made it possible anyway, and the law simply hasn’t caught up.
The loophole isn’t a bug in the system. It is the system. Webloc is just what that system looks like once a federal agency decides to use it at scale.
What You Can Do
I won’t pretend there’s a setting that fully protects you here. There isn’t. The broker market operates upstream of your phone’s privacy controls, and a lot of what’s already out there can’t be pulled back. That’s the uncomfortable truth. But these steps narrow what happens from here.
THIS WEEK
Go into your phone’s location settings and switch apps from “Always” to “While Using” or “Never.” iPhone: Settings > Privacy & Security > Location Services. Android: Settings > Location > App permissions. This stops any new collection. It doesn’t touch what’s already been sold.
Turn off ad tracking, since that’s the identifier brokers use to stitch your data together across apps. iPhone: Settings > Privacy & Security > Tracking, switch off “Allow Apps to Request to Track.” Android: Settings > Google > Ads > Delete advertising ID. Brokers have other fingerprinting tricks, but these raise their costs.
Set your social accounts to private. Tangles scrapes public posts, photos, location tags, and connections. Privacy settings limit what it can grab going forward. They don’t erase what’s already taken.
One honest caveat: Webloc can infer location from IP addresses and Wi-Fi signals even with GPS permission switched off entirely. Nothing on your phone closes that gap completely.
THIS MONTH
Call your senators. Ask them to bring the Fourth Amendment Is Not For Sale Act to a vote. It’s already passed the House. The Senate is the only thing standing between your location history and the next federal purchase order. Find them at senate.gov. Phone calls get to a staffer. Emails go into a queue.
A quick closing thought. If this piece made you want to put your phone down, too, you’re not alone. I’ve heard from enough of you over the past months to know I’m not the only one who feels this way about what’s happening to all our data. That’s part of why I keep doing this.
Regards,
Pam
Thanks for the article. What stood out to me wasn't the specific agency involved as much as the structure of the system itself. Most people understand they're exchanging some privacy for convenience when they use apps, but very few understand where that data can ultimately end up or how many different parties may have access to it.
The broader question seems less about technology and more about incentives. Once a market exists for highly detailed personal data, it shouldn't be surprising that both private and public institutions find uses for it. I suspect many people would be surprised to learn how much information they have already agreed to share without fully understanding the downstream consequences.
Thought-provoking piece.