ICE Is Tracking Your Neighborhood. It Bought the Data From an App on Your Phone.
A surveillance tool called Webloc lets federal agents draw a circle on a map and pull the location history of every phone inside it. No warrant required.
A May 2026 technical analysis by the Citizen Lab confirmed what ICE has been quietly doing since September: using a tool called Webloc to monitor entire neighborhoods for mobile phones and pull location history without a warrant. The data comes from the apps on your phone. The legal theory is that you consented when you tapped “allow.”
THREE THINGS YOU NEED TO KNOW
1. ICE can surveil your block without a warrant, using data your apps already collected. A surveillance tool called Webloc lets ICE agents draw a geographic perimeter on a map and retrieve the movement history of every mobile device inside it. The data comes from the commercial location market, sourced from hundreds of millions of phones via advertising identifiers. ICE’s own internal legal analysis says no warrant is required because users “voluntarily” shared the data with apps.
2. ICE reversed its own policy to buy this. Under pressure from Congress, ICE stopped purchasing commercial location data by early 2024. It restarted in September 2025 with a no-bid contract, awarded without competitive bidding, worth up to $2.3 million for one year. The company that won it, Penlink, was previously banned from Meta for targeting activists, opposition politicians, and government officials in Hong Kong and Mexico.
3. Congress already passed a fix. The Senate has not acted on it. The Fourth Amendment Is Not For Sale Act would require a warrant before the government could buy this kind of data. The House passed it in 2024. It has not passed the Senate. Until it does, every American’s commercial location history is available for purchase by federal agencies, no judge required.
“This is probably unconstitutional. Usually, if law enforcement wants to take your phone and is interested in getting your location data, they would need a warrant, but because the law has not kept up with technology, there is this loophole that effectively has allowed law enforcement to purchase location data, which is highly sensitive, without getting a warrant first.”
-Don Bell, Policy Counsel, Constitution Project at the Project on Government Oversight
The Contract
On May 5, 2026, the Citizen Lab at the University of Toronto published a technical analysis of Webloc, the geolocation surveillance tool ICE has been using since September 2025. The analysis confirmed that Webloc ingests commercial location data from hundreds of millions of phones and allows law enforcement to map the movement of every device inside a defined geographic area, without a warrant.
The underlying contract had been reported by 404 Media in January. ICE’s Homeland Security Investigations unit issued a no-bid contract to Penlink, a Nebraska-based surveillance company, in September 2025 for licenses to two products: Webloc and Tangles. The contract runs through September 2026 and is valued at up to $2.3 million. ICE described the tools as “essential” and “an integral part” of its investigative mission. In April 2026, DHS awarded Penlink an additional contract worth $2.9 million, further expanding the relationship.
How Webloc Works
Webloc is a geolocation surveillance tool originally developed by Cobwebs Technologies, an Israeli firm that Penlink acquired in a $200 million private equity deal in 2023. It ingests commercial location data sourced from hundreds of millions of phones via mobile advertising identifiers, GPS signals, Wi-Fi signals, and IP-based location information.
An ICE agent using Webloc can draw a geographic perimeter on a map, such as a neighborhood, a city block, or the area around a specific address, and retrieve the movement history of every mobile device that appeared inside that perimeter during a defined time window. The system can then follow individual devices outward from that location to infer home addresses, workplaces, and other frequent locations.
Penlink’s own promotional material describes Webloc as a “digital intelligence package for national security.”
How Tangles Works
Tangles is a social media surveillance tool that combines web scraping with access to social media application programming interfaces. It can aggregate a person’s posting history, comments, keywords, location tags, photos, and social connections. It can detect faces in images, identify individuals, analyze the sentiment of posts, and place accounts on a watch list.
Used together, Webloc and Tangles allow ICE to correlate physical location history with social media activity, building a detailed profile of an individual’s movements, relationships, and online behavior. ICE selected Penlink specifically because it offers this kind of integrated, all-in-one capability.
The Legal Theory
The Supreme Court ruled in Carpenter v. United States (2018) that obtaining cell-site location records from a carrier requires a warrant. That ruling covered data held by telephone companies.
The government’s workaround is the commercial data broker market. Because location data collected by mobile apps flows through advertising networks and is sold by data brokers, the government argues that users voluntarily disclosed it to third parties and therefore have no expectation of privacy in it. Under this theory, the government can purchase what it cannot legally seize.
ICE’s internal legal analysis, obtained by 404 Media, applies this logic directly to Webloc. The analysis concludes that commercial location data can be queried without a warrant.
Civil liberties experts reject the argument. The Constitution Project at the Project on Government Oversight called it “probably unconstitutional.” The ACLU has stated that no one carrying a phone consents to a government record of their every movement.
Who Built the Tool
Cobwebs Technologies, the Israeli firm that developed Webloc and Tangles, was banned from Meta in 2021 as part of a crackdown on surveillance-for-hire companies. Meta’s investigation found that Cobwebs customers had used its tools to target activists, opposition politicians, and government officials in Hong Kong and Mexico.
In 2023, Spire Capital acquired Penlink and merged it with Cobwebs in a $200 million deal, combining Penlink’s telecommunications interception capabilities with Cobwebs’ geolocation and social media surveillance products.
ICE has contracted with Penlink before. In 2018, the agency signed a $2.4 million contract for Penlink’s telecommunications analysis software.
Congressional Response
72 Democratic members of Congress, led by Sen. Ron Wyden and Rep. Adriano Espaillat, sent a letter to the DHS Inspector General in March 2026 requesting an investigation. Sen. Wyden’s office had requested a briefing from ICE in October 2025. ICE scheduled it for February 2026. As of early March, ICE had not provided it.
The House of Representatives passed the Fourth Amendment Is Not For Sale Act in April 2024. The legislation would require the government to obtain a court order before purchasing location data or other sensitive personal information from data brokers. The Senate has not taken up the bill.
This is Not Just an Immigration Story
Webloc does not sort phones by citizenship before it maps a neighborhood. When an ICE agent draws a perimeter, every device inside it gets captured: the undocumented worker, the citizen walking a dog, the journalist, the activist, the person who attended a protest, the patient who visited a clinic on that block.
The tool does not know who you are. It knows where your phone was.
Tangles compounds this. Once a device is flagged from a location sweep, Tangles can pull that person’s social media history, photos, connections, and keyword activity. A citizen who happened to be in the wrong place at the wrong time can find themselves in a federal dossier built entirely from data they generated voluntarily, using apps that promised them convenience.
The commercial location market does not ask why you want the data. It asks whether you can pay. ICE can pay. So can any other agency that decides a neighborhood is worth watching.
The apps that collected this data told you they used it to improve your experience, serve you relevant ads, and remember your preferences. That was true. It was also incomplete. The same data that helped you find a parking spot or saved you fifteen minutes on your commute is now available, in bulk, to any government agency willing to write a check and invoke the third-party doctrine.
You did not consent to that. You were not told that was possible. The permissions prompt did not say so.
Coercive Capitalism
Coercive Capitalism describes systems that do not force compliance but engineer it by exploiting the gap between what people understood they were agreeing to and what they actually gave up.
This story fits that definition precisely.
Mobile apps offered navigation, weather, ride-sharing, and retail discounts. Users accepted. The benefit was real. A weather app that knows your location gives you a better forecast. A navigation app that tracks your movement saves you time. A retail app that remembers where you shop saves you money. These are genuine consumer benefits, and the apps delivered them.
The cost was location access, disclosed in a permissions prompt that most people tapped through in under a second. That is the voluntary trade. What the prompt did not say was where the data would go next.
The data did not stay with the app. It flowed into the commercial advertising ecosystem, where data brokers aggregated, packaged, and sold it. ICE did not hack anyone’s phone. It went shopping. The same marketplace that sells your location to a car dealership trying to reach you on your commute sold it to a federal agency building a neighborhood dragnet. That data is used as a financial instrument and transacted against the same people who generated it.
The exit cost is what seals it. You cannot retrieve your historical location data from the broker market. You cannot unshare it. The moment you tapped “allow,” that data entered a pipeline with no off-ramp. The people who handed over their location for a discount or a turn-by-turn direction did not agree to be surveilled by immigration enforcement. But the architecture made it possible, and the law has not caught up.
The data broker loophole is not a flaw in the system. It is the system. And Webloc is what the system looks like when a federal agency decides to use it.
What You Can Do
There is no individual setting that fully protects you from this. That is the point. The data broker market operates upstream of your phone’s privacy controls, and much of what has already been collected cannot be retrieved.
That said, these steps reduce your exposure going forward.
THIS WEEK
Review location permissions on your phone and switch apps from “Always” to “While Using” or “Never.” On iPhone: Settings > Privacy & Security > Location Services. On Android: Settings > Location > App permissions. This stops future collection by those apps. It does not delete what has already been sold.
Disable ad tracking to break the identifier brokers use to link your data. On iPhone: Settings > Privacy & Security > Tracking, turn off “Allow Apps to Request to Track.” On Android: Settings > Google > Ads > Delete advertising ID. Brokers have other ways to fingerprint devices, but removing the advertising ID raises the cost of tracking you.
Set social media accounts to private. Tangles scrapes public posts, photos, location tags, and social connections. Making accounts private limits future scraping. It does not remove what was already collected.
Note: Webloc can infer location from IP addresses and Wi-Fi signals even without GPS permission. No phone setting eliminates that exposure entirely.
THIS MONTH
Contact your U.S. senators and ask them to bring the Fourth Amendment Is Not For Sale Act to a vote. The bill passed the House. The Senate is the only thing between your location history and a federal purchase order.
Find your senators at senate.gov. Phone calls reach staff. Emails go into a queue.
Sources
404 Media. Inside ICE’s Tool to Monitor Phones in Entire Neighborhoods. January 9, 2026. 404media.co.
Citizen Lab. Uncovering Webloc: An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech. May 5, 2026. citizenlab.ca.
ACLU. DHS is Circumventing Constitution by Buying Data It Would Normally Need a Warrant to Access. January 15, 2026. aclu.org.
Common Dreams. Democratic Lawmakers Demand Probe Into DHS Warrantless Location Tracking. March 4, 2026. commondreams.org.
NPR. Your data is everywhere. The government is buying it without a warrant. March 25, 2026. npr.org.
Newsweek. ICE Buying Americans’ Location Data Under Scrutiny. March 5, 2026. newsweek.com.
Rep. Shontel Brown. Brown Leads Oversight Letter to DHS on ICE’s Troubling Mass Surveillance Tech. February 19, 2026. shontelbrown.house.gov.
Electronic Frontier Foundation. Fourth Amendment Is Not For Sale Act Passed the House, Now it Should Pass the Senate. April 18, 2024. eff.org.