Police Are Buying Your Phone’s Ad Data. The Supreme Court Hasn't Closed the Loophole.
November 5, 2026. Every time a phone app loads an ad, data about the phone can change hands. A tool called Webloc turns that exhaust into a map: Citizen Lab reports it can search up to 500 million mobile devices, with three years of history, for police departments and federal agencies.
The legal question is whether buying that data is a search. The Supreme Court has ruled on warrants served on Google. It has not, so far as we found, ruled on data that agencies simply purchase.
- 500Mdevices searchableWebloc's claimed reach, with three years of history, per Citizen Lab's April 2026 report.
- $2.3MICE license valueUp to this amount for Tangles and Webloc licenses, September 2025 to September 2026, per Citizen Lab.
- 219-199House voteThe Fourth Amendment Is Not For Sale Act passed the House in the 118th Congress and died in the Senate.
Webloc was built by Cobwebs Technologies and has been sold by Penlink since the two merged in 2023, as an add-on to its Tangles platform. Per Citizen Lab, its data comes from app software kits and real-time-bidding ad auctions, often through data brokers, and updates every 4 to 24 hours; the researchers could not confirm the current source. Penlink told Citizen Lab it gets location data “from providers who obtain user consent” and that the report describes “products that no longer exist.”
It is not new. In 2022, AP and the Electronic Frontier Foundation reported that police were using a similar product, Fog Reveal, to follow advertising IDs across about 180 days without warrants, with agencies able to buy in for under $10,000 a year, per the EFF.
Citizen Lab filed 96 public-records requests in 14 countries. Its report names federal users including ICE and Homeland Security Investigations, the Office of Naval Intelligence and the Army Space and Missile Defense Command, and state and local users including Texas DPS, the LAPD, Dallas, Baltimore County, Tucson and Durham police, and the Queens and Bronx district attorneys. The LAPD queried Cobwebs 136 times in 2022 and 1,319 times in 2023, per the report. Texas DPS signed an initial $198,000 contract in 2021.
One federal agency pulled back. Per Bloomberg Law, the ATF ran a Webloc pilot, “determined the tool does not meet our needs and cancelled the contract,” and said it is “not currently using any other ad-tech-sourced services.” Sen. Ron Wyden (D-OR) announced the cancellation. Wyden also led roughly 70 Democrats in March asking for an investigation of ICE and DHS purchases of location data; DHS told The Register that “ICE does not purchase illegal information.”
In Carpenter v. United States (2018) the Supreme Court required a warrant for carrier cell-site records. Agencies argue that buying commercially available data is not a search at all. The most recent ruling concerns a different method: per the Independent Institute and Bloomberg Law, in Chatrie v. United States the Court held 6-3 in late June 2026 that a geofence warrant is a Fourth Amendment search, and sent the case back on particularity and probable cause, without banning geofences. Those warrants go to Google. Data an agency purchases from a broker never reaches a judge, which is the gap.
Congress has tried to close it. The Fourth Amendment Is Not For Sale Act passed the House 219-199 in the 118th Congress and died in the Senate. A coalition that includes the Brennan Center and more than 25 other groups has urged the Senate Judiciary and Homeland Security committees to advance it again. In September, per US News, the U.S. military turned off ad trackers on devices after reports that the data exposed troops.
Documented: Webloc’s claimed reach, named agency customers, ICE’s license value, the ATF cancellation, and the House vote on the bill.
Disputed: the data’s current source and consent. Penlink says its providers obtain consent and that parts of the report are outdated.
Not documented: a court ruling on warrantless purchase of ad data, or any specific case in this report where a purchase was ruled unlawful.
A warrant protects you when police ask Google. It does not when police simply buy the same trail from a broker. Courts have closed one door and left the other open, and a bill to shut it has already passed the House once.
