Citizen Lab Counts 12 Countries Using Penlink's Webloc Ad-Data Tracking

Citizen Lab says security agencies in 12 countries now use Webloc, a phone-location system from the surveillance vendor Penlink that runs on data harvested from mobile apps and digital advertising. The count comes from a November 12, 2026 update that adds Austria's Ministry of the Interior to the three customers the lab named in April, and folds in eight more from a Bloomberg investigation.

Who the 12 countries are

Citizen Lab's April report named the United States, El Salvador and Hungary. The November update confirms Austria through its Ministry of the Interior. The page then lists the customers from the Bloomberg investigation, which it says "align" with the lab's own findings: the United Kingdom, the Netherlands, Germany, Mexico, Singapore, Saudi Arabia, the United Arab Emirates and Israel.

Citizen Lab's senior researcher Wolfie Christl calls Webloc "a powerful mass surveillance tool that's trickling down from military and intelligence agencies". The page says its method combined "open source research, freedom of information requests, and server infrastructure mapping". The update does not include a response from Penlink, and this article did not retrieve the Bloomberg piece itself.

What Webloc is, from the April report

The Hacker News summarised the original Citizen Lab analysis on April 11, 2026. Webloc was built by the Israeli company Cobwebs Technologies, and Penlink sells it after the two firms merged in July 2023. It is an add-on to the Tangles social media and web intelligence system.

Citizen Lab describes "a constantly updated stream of records from up to 500 million mobile devices across the globe". Each record includes a device identifier, location coordinates and profile data. Customers can follow the movements of entire populations up to three years back, infer location from IP addresses and work out home addresses and workplaces.

The article lists United States users including ICE, the U.S. military, the Texas Department of Public Safety and police in Los Angeles, Dallas, Baltimore, Tucson and Durham. Hungarian domestic intelligence and El Salvador's national police are the foreign customers named in April. Penlink replied at the time that the findings "appear to rely on either inaccurate information or a misunderstanding about how we operate."

The server count

Citizen Lab identified 219 active servers tied to Cobwebs deployments. The six countries it broke out:

1. United States126 servers
2. Netherlands32 servers
3. Singapore17 servers
4. Germany8 servers
5. Hong Kong8 servers
6. United Kingdom7 servers

Source: Citizen Lab analysis as summarised by The Hacker News, April 11, 2026

Server location is not customer location. A server in the Netherlands says where a machine sits, not which government pays for it, and the summary does not claim otherwise.

What is and is not established

The November update does not explain the technical path from an app to the stream, and the April summary does not describe the advertising-bidding or software-kit mechanics either. So the claim that a given weather or game app feeds Webloc is not one this reporting can make. What is documented is the output: the record types, the 500 million device ceiling and the customer list.

The history of the vendor is documented too. Meta removed Cobwebs in December 2021 as one of seven "cyber mercenaries", citing about 200 accounts used for reconnaissance and social engineering. Citizen Lab links Cobwebs to the Israeli spyware vendor Quadream through founder Omri Timianker, who now oversees Penlink's international operations.

The lab calls the lawfulness of these systems in Europe and the UK "highly controversial" and says "intrusive and disproportionate ad-based mass surveillance is problematic everywhere".

For another story about personal data at scale, see the Arara Message breach that exposed 77 million addresses. For a flaw in software most readers run daily, see Chrome 157's XML zero-day.