Webloc, a surveillance tool developed by Penlink, uses location data collected through tracking software in popular smartphone apps to map people’s movements for law enforcement; company documents say it can monitor hundreds of millions of phones and retain up to 70,000 location points per device from the previous 12 months.

The tool draws on advertising IDs and sometimes GPS, Wi-Fi and cell-tower data, which can be refreshed hourly, allowing officers to see which phones were recorded at a particular place and time.

Penlink says it gets the information from data partners with agreements with app developers, rather than directly from apps; one possible source, Start.io, says its software is embedded in more than 500,000 apps and can reach 2.4 billion devices worldwide.

Documents reviewed by Bloomberg linked Webloc’s data to apps including AccuWeather, Muslim Pro and Multi Maze 3D, although the app owners said they had no commercial relationship with Penlink and did not provide it with user data.

Webloc users in the United States include ICE, at least two military units and dozens of police departments; Bloomberg records show ICE spent about $9 million on contracts with Penlink and Cobwebs from 2022 to 2026, while authorities in several other countries also use the technology.

A Citizen Lab report identified police departments in Los Angeles, Dallas, Baltimore and Tucson as users; Tucson police said Webloc assisted burglary and robbery investigations and an investigation into a university student’s abduction, but the department’s license expired and was not renewed.

U.S. law enforcement agencies use Webloc without a court order, relying on the Justice Department’s position that the warrant requirement for location records held by telecommunications companies does not apply to data bought commercially.

Digital-rights experts warn that people may not know their app data can reach surveillance companies, since terms of use often mention third-party sharing without naming recipients; the American Civil Liberties Union’s Nathan Freed Wessler said weak oversight could expose people the government has no authority to investigate.

Penlink says Webloc is designed to support law enforcement and public safety, and that its data partners obtain consent and remove sensitive locations such as hospitals, schools and houses of worship; experts say public agencies’ use of privately collected data still lacks adequate oversight.

Montana bars law enforcement from buying commercial location data without a court order, while Oregon, Maryland, New Jersey and Virginia have also restricted sales of precise location data; Penlink said it stopped collecting location data from people in those states.