IC Technology & Cyber — 2026-11-13

Citizen Lab and Bloomberg Expose Global Spread of Penlink's Webloc Ad-Based Surveillance System

BLUFDocumented spread of ad-based surveillance from intelligence agencies to local police across democracies and authoritarian states alike will intensify European legal challenges and accelerate further customer disclosures.

A Bloomberg investigation identified additional government customers of Penlink's Webloc ad-based tracking system, including agencies in the UK, Netherlands, Germany, Mexico, Singapore, Saudi Arabia, the UAE, and Israel 1. The Citizen Lab said on November 12 that these findings align with potential customers it named in an April report, which used open source research, freedom of information requests, and server infrastructure mapping to identify Webloc users in the US, El Salvador, and Hungary 1. Citizen Lab also reported that the Austrian Ministry of the Interior has since been confirmed as a customer 1. Citizen Lab researcher Wolfie Christl described Webloc as a mass surveillance tool moving from military and intelligence agencies to federal law enforcement and then to state and local police 1.

Analysis
Ad-based location tracking has become a standard tool for security services in at least a dozen countries, and the Gulf and Israeli customers point to authoritarian use. European and UK agencies now face legal exposure, since Citizen Lab calls the lawfulness of such systems in Europe and the UK highly controversial and regulators and parliamentary overseers now have a documented customer list to examine. Penlink's sales have shifted from intelligence and military users to federal police and then state and local police, so wider police adoption should follow. More governments could be named in coming months through freedom of information requests and server mapping. Confidence is high, resting on Bloomberg's primary investigation and Citizen Lab's April infrastructure mapping, though Citizen Lab's post largely relays Bloomberg, so the two are linked. Some named agencies may hold only trial licenses, and procurement records may overstate active use.

2 sources

Security Agencies Worldwide Found to Use Ad-Based Surveillance System - Citizen Lab
Privacy Concerns Over Ad Tech Giving Police Greater Power to Track Phones - Bloomberg