(Headline article below) There are a couple new tidbits, but most is already known. And blocking ads is a security feature these days as they can feed you malware as well as the bidding process reveal, and just look at how they abuse it. At home run your own Pi-Hole/Unbound DNS servers with ad, telemetry and malware blocking protecting every device on your home network, and/or use a VPN with the same features that can be enabled in the application for their DNS servers like Mullvad VPN.
https://reclaimthenet.org/inside-the-leaky-plumbing-of-commercial-surveillance
The data broker economy turns ordinary errands into evidence, then sells the map.
By Ken Macon
Ordinary ad tech builds a minute-by-minute record of where your phone goes, and it’s for sale. Here’s how to get off the map, and what you can’t undo.
In sales pitches to law enforcement around the world, Penlink has shown how its product, Webloc, can be used for “tracking people as they walked down Fifth Avenue in New York City, visited the European Central Bank in Frankfurt, and moved close to the UK Parliament in central London.”
What these demonstrations showed is ordinary people on an ordinary street – but the dots on the map that represent them are anything but ordinary. They are precise and timestamped, and can be searched for.
The question is, could your phone be one of those dots? If you live in the US, no judge is involved.
In the US, it “can be used without the need for any kind of search warrant or judicial authorization.” Officers can “zero in on a map and look at all phones that were present at a specific place and time,” analyzing “billions of location data points,” according to company documents.
The data is collected from apps on phones – “commonly used weather, gaming, email and religious apps,” as Bloomberg recently wrote.
The data can be updated hourly, and show where a phone has been “over the past 12 months.”
In one of the sales presentations, Penlink said that Webloc can track “hundreds of millions of mobile phones across the world.”
The ACLU’s Nathan Freed Wessler calls it a “ridiculous expansion of these tools” that raises “tremendous concerns.” He said, “It means that people are going to be investigated who the government has no business investigating.”
Even though the tool is powerful, it’s becoming more and more available to more and more law enforcement agencies. Citizen Lab researcher Wolfie Christl said, “This is a powerful mass surveillance tool that’s trickling down from military and intelligence agencies to federal law enforcement and then to state and local police.”
Cobwebs, a company founded in 2015 by three veterans of Israeli special forces, developed the Webloc tool for counterterrorism, and it is now in the hands of police and government agencies in several countries, including the US, UK, Saudi Arabia, and others, according.
Cobwebs was merged in 2023 with Penlink, a US company that has been around since 1986 and has a long history of providing law enforcement with tools to analyze wiretapped communications.
The report is based on Penlink’s internal documents and people familiar with Webloc’s development, and it details how the tool uses data harvested from apps on people’s phones, often those that track location for advertising purposes, and sells it to law enforcement, who in the US can access it without a warrant.
Webloc is an add-on to Penlink’s Tangles, a tool to monitor social media, and licenses to use it start at $100,000 a year. Data is collected from apps that are on millions of phones, and the tool can show where a phone has been over the past year, updated hourly.
Documents show that among the US customers are Immigration and Customs Enforcement (ICE), at least two branches of the US military, and over a dozen police departments, while abroad, the UK, Saudi Arabia, the UAE, Singapore, the Netherlands, Germany, Austria, and Hungary are named as countries whose law enforcement agencies are buying Webloc.
ICE has spent $9 million on four contracts that included Webloc licenses between 2022 and 2026, and although the Tucson police department in Arizona used it to track down a thief, it let its license expire.
Penlink is not confirming any of its customers or commenting on them. But Sean White, a partner at the company’s owner, Spire Capital, said that the right of US law enforcement to buy access to commercially available data is “still an open question.”
The tool is demonstrated to police as a means to track and identify protesters and to follow members of motorcycle gangs.
The first “pipe” that lets your phone’s location be turned into a searchable record that law enforcement can buy without a warrant is the software development kit (SDK).
It is embedded in many apps, and although those who develop and use them may not be aware of this, the SDKs can collect and share a vast amount of personal data.
According to the University of Toronto’s Citizen Lab, these are third-party tracking software that are “embedded in mobile apps” and “can potentially access all data that the mobile app they are embedded into can access.”
To bypass phone OS restrictions, Citizen Lab continues, “data collection efforts focus on apps that require access to location data such as weather, navigation, fitness, and dating apps.”
It was the Bloomberg report that named some of the apps from which the Webloc system gathered the data: Accuweather, Muslim Pro, and Multi Maze 3D.
The three app makers denied any relationship with Penlink, the company behind Webloc. Accuweather said it has “absolutely no relationship, commercial or otherwise, with Penlink,” while Bitsmedia, which owns Muslim Pro, said it was “unaware of any arrangement between Penlink and any third-party technology provider involving location data originating from Muslim Pro.”
Penlink responded by saying that its “data partners provide data from their own SDK relationships and represent that they obtain consent through their app partners; they do not provide Penlink with a comprehensive list of those app partners.”
So even if the app makers are telling the truth – and they probably are – the tracker embedded in their apps doesn’t answer to them, and nobody is willing to name the next link in the chain.
Some of Webloc’s data was sourced from the Israeli company Start.io, which embeds its SDK in apps and pays the developers for doing so. Start.io is present in over 500,000 apps and markets “a 360-degree view of consumers.”
Exodus, a platform that audits Android apps, found Start.io’s tracker in more than 4,400 apps. Penlink denied buying data from Start.io, but admitted that Cobwebs, the company it merged with in 2023, ran a “trial” using Start.io data.
Bloomberg noted that even app developers “may not know” that the trackers they use for advertising purposes ultimately sell location data to companies like Penlink.
Even if they did, it would be beside the point, because the SDKs “piggyback on whatever permissions the app already has, particularly location, and quietly siphon data back to the aggregator,” as we reported in April.
Meanwhile, Thorsten Wetzling of the Berlin-based think tank Interface told Bloomberg, “I’ve yet to come across anyone who has explicitly consented to these private companies handing over data for surveillance purposes.”
The second pipe that feeds the vast surveillance state is ad auctions, and it is here that the industry’s plumbing gets particularly leaky.
The killer detail is that every bidder – not just the winner – gets to see the data, and all can store it regardless of whether or not they end up buying the ad space.
Citizen Lab also said that the data is broadcast without any security and that surveillance vendors either buy it from brokers or participate in the auctions to get it.
The Electronic Frontier Foundation (EFF) has also explained that real-time bidding (RTB), as this process is known, is inherently leaky: “a key vulnerability of real-time bidding is that while only one advertiser wins the auction, all participants receive the data.”
While location data is particularly sensitive, the bid request that is sent out to bidders contains a lot of other personal data, including “your unique advertising ID, location, IP address, device details, interests, and demographic information.”
The EFF said that the US Federal Trade Commission (FTC) found one broker, Mobilewalla, to be in possession of data on over a billion people, and that about 60 percent of it came from RTB auctions where it did not even bother to place an ad.
A US Customs and Border Protection (CBP) document we reported on in March contained the following note: “RTB-sourced location data is recorded when an advertisement is served.”
It’s not only the number of people who are tracked this way that is mind-boggling – the Irish Council for Civil Liberties (ICCL) says the industry broadcasts information about us “hundreds of billions of times, every day.”
As for Webloc, Citizen Lab found that its data likely came from SDK sources in 2021, because its documents from that year show Wi-Fi data, which is not available to those who source it from RTB.
So, here is your file. You, as in, the data that is being collected, stored, analyzed, and sold, and in the end, used to build a pretty accurate picture of your life, your habits, your interests, your relationships – and your identity.
Citizen Lab was able to see some of the data held by Webloc thanks to three government documents: one from El Salvador, one from Vietnam, and one from the US Navy.
The documents show that Webloc holds personal identifiers, location data, inferred data such as home and work location, as well as “most visited locations,” device data, personal characteristics, and behavioral profiles.
Other data that’s collected includes GPS coordinates, Wi-Fi location, and the precision of that data. The system also collects “device model, manufacturer, type, operating system,” as well as “age, gender, locale/language, parent (y/n), traveller (y/n), gamer (y/n).”
Then there’s the “list of mobile apps used, including the period of time each app was seen on the device.”
The behavioral profile segment is where things get particularly sensitive, as it can contain inferences about a person’s health, sexual orientation, or financial situation.
Citizen Lab was able to see a profile of a man in Abu Dhabi, whose phone sent 81 GPS coordinates over the course of five days, while Wi-Fi signals also located him 110 times. The phone was also identified as having 141 apps installed.
Another example is that of a man in Hungary, aged 18-24, who used a Samsung Galaxy S8, was a regular commuter, and was interested in basketball and luxury goods.
Penlink claims that it only holds location data tied to device IDs, but Citizen Lab says it “cannot verify this claim.” The same report said that the categories used to segment people for advertising purposes can reveal “employment, political views, religion and sexual orientation to pregnancy, health issues or personal debt.”
The US Federal Trade Commission (FTC) is quoted as saying that advertising IDs “offer no anonymity in the marketplace.”
“Many parties can easily retrieve the name, email address and phone number associated with an advertising ID, and vice versa,” said Citizen Lab.
It’s not like a person’s name is needed to build an accurate, and very revealing, picture of their life. The device that is always at a given location during the day is likely to be its user’s workplace.
Citizen Lab says that if an individual’s phone is identified as having visited a place of worship, it can reveal their religion, while frequent visits to a hospital can indicate a person’s health issues.
Penlink, the maker of Webloc, promises that its data providers “obtain user consent for location data sharing and filter out sensitive locations,” naming hospitals, schools and places of worship.
The US Navy, meanwhile, said in one document that Webloc can be used to “find and establish relevant and meaningful relationships and connections to individual’s virtual and physical patterns of life.”
The data is not always precise – but it doesn’t have to be, Citizen Lab is saying. “For targeted surveillance, however, it does not matter whether 90% of the data is flawed, as long as the target’s device identifier is in the set,” the report reads.
Citizen Lab found that the Tucson police used Webloc to find the apartment address and workplace of a suspect – and of his romantic partner.
The first step in reclaiming your privacy from the dragnet-style data harvesting that feeds the location tracking industry is to know what is happening on your phone.
Apple users can turn to the App Privacy Report introduced with iOS 15.2, which, once turned on, shows the data each app has accessed, its network activity, and the web domains that all apps contact most frequently. The data is stored encrypted on the device.
On Android, the Exodus website analyzes apps for embedded trackers, and the report will show what trackers are embedded into the application.
These tools are not the same as the permission screens you see when you install an app. Those will tell you what the app may touch on your phone – but not who it talks to. To find that out, look at the domain list and the tracker list.
If you are concerned about location data, one simple step is to get rid of third-party weather apps, since your phone’s built-in one will do the job. And while you’re at it, delete any free torch or free game apps.
To remove your location history from the clutches of data brokers, first you have to remove it from your device, and then from the brokers’ servers.
The identifier that ad tech uses to turn your every move into a record that can be searched and bought is the ad ID, which is stored on your phone and can be read by apps. So, to get off this particular tracking and data collection “map,” the first step is to get rid of the identifier.
On an Android phone, the process is a little more complicated because of the order in which you have to do things. First, you have to go to Settings, find Privacy, and then Ads, and copy your ad ID because you will need it in the next step. If you delete it first, the phone will show a string of zeros and the deletion request that follows will not work. So, copy the ID, then delete it.
On an iPhone, go to Settings, then Privacy & Security, then Tracking, and switch off “Allow Apps to Request to Track.” This will stop the apps from accessing the system advertising identifier (IDFA).
Next, go to Location Services and set it to “Never” for each app that does not need it. Additionally, you can turn off “Precise Location” to share only your approximate location, which is often “sufficient for an app that doesn’t need your exact location.”
Google has a similar setting for apps’ precise location permission that can be managed on Android 12 and later versions.
Even after you restrict location permissions, there are still a number of ways it can find out where you are, and then sell that information to third parties, who can then buy it, without the need to obtain a warrant.
One of the ways this can happen is by accessing the name of your router, as well as the names of the routers you connect to when you’re away from home. This information can reveal your last name, your workplace, and the places you visit. This is one of the many disturbing findings of a new report by Canada’s Citizen Lab.
You can minimize the damage by changing the name of your router to something that doesn’t identify you, and adding “_nomap” to the end of it – but this will only keep it out of Apple’s and Google’s location databases, not prevent an app from reading it.
In fact, the two giants make it clear that adding “_nomap” at the end of the router name is a way to keep it out of their crowd-sourced location maps – but they don’t mention anything about it stopping an app from reading the name of your router. That’s why it’s essential that the name doesn’t reveal your identity or location.
Another way to stop your location being revealed is to turn off Wi-Fi scanning, and on Android 12 and higher, this can be done by going to Settings, Location, Location Services, and then turning off Wi-Fi scanning or Bluetooth scanning. On Samsung phones, the path is Location, Improve accuracy.
Then there’s your IP address, which can give away your city-level location, the Citizen Lab report said. This can be mitigated by using a VPN, which will hide your IP address from the ad network, and show them the IP of the VPN server instead.
Separately, a filtering DNS service can be used that blocks known tracker domains.
To get off the map, you need to get rid of the record of your location. And to do that, you have to ask the company holding it to delete it. The ad ID you have hopefully saved by now is the key to this, as a deletion request that quotes it is much harder to brush off.
The idea is to use this unique identifier to prove to the data broker that you are the owner of the device whose location has been logged and sold to the highest bidder, including the police. Without it, the broker can easily claim that it cannot find your record.
Several US states and the EU have laws that are supposed to make this possible, but the process is far from straightforward. In California, the Delete Act and DROP are supposed to streamline this process, but the former only applies to data brokers that are registered with the state, while the latter is a single opt-out request that can be submitted to all active data brokers at once, and it’s not clear what the success rate is.
The CCPA, California’s privacy law, gives residents the right to ask that their personal information be deleted, including from service providers, but there are many exceptions.
In the EU, GDPR Article 17 states that personal data must be erased “without undue delay,” though here as well, there are exceptions.
The only way to ensure your record is deleted is to name it. This means you have to provide the ad ID when submitting your deletion request. The effect is limited to the future: any data that has already been sold remains out there.
Even if you get rid of your phone’s location data from the clutches of one data broker – or even several – the problem is not solved.
The data that has already been sold stays sold. And generating a new ad ID will make you appear as a new person to the data harvesting and brokering industry, but it will not erase the trail of data that has already been collected from your device. It will not make you invisible to the industry, it will only make you look like a new, different person.
That is because a new ad ID does not delete the old one and the data associated with it. Webloc keeps it – 12 months, according to Bloomberg, while a 2023 contract document mentioned three years.
This data is constantly changing hands, Citizen Lab has found. “Almost certainly, Webloc’s data sources are different in 2026,” the lab said in its report.
With your ad ID, you have a chance to get your record deleted from one broker, but the data will still be out there, sold to somebody else, and there’s no way to know who that is.
The only way to ensure that this data cannot be bought by the police is for a law to be passed that requires a warrant for the purchase. Until that happens, the only record that nobody can sell is the one that was never sent.