Bloomberg and Citizen Lab link Penlink's Webloc ad tracking to security agencies worldwide

Penlink's Webloc tied to agencies across three continents

A Bloomberg investigation into Webloc, an ad-based tracking system sold by Penlink, has surfaced a roster of security-agency customers spanning multiple continents. The reporting extends earlier work by Citizen Lab, which said the newly reported buyers match the list of potential customers its own researchers had flagged in a report published in April.

According to Citizen Lab, Bloomberg identified Webloc customers in the UK, the Netherlands, Germany, Mexico, Singapore, Saudi Arabia, the UAE and Israel. Those countries add to the users Citizen Lab had already documented: agencies in the United States, El Salvador and Hungary, uncovered in its April investigation, along with Austria's Ministry of the Interior, which was confirmed as a customer after that report appeared.

How researchers pinned down the customer list

Citizen Lab's April report relied on open-source research, freedom-of-information requests and mapping of the server infrastructure behind Webloc to establish who was operating the system. The lab says Bloomberg's subsequent reporting, which identified buyers in further countries, lines up with those earlier findings.

Wolfie Christl, a senior researcher quoted in Citizen Lab's summary of the story, is blunt about the tool's reach. Webloc, he says, "is a powerful mass surveillance tool that's trickling down from military and intelligence agencies to federal law enforcement and then to state and local police."

Legality is contested

Citizen Lab argues that the legal basis for running such systems in Europe and the UK is highly disputed. In the lab's view, intrusive and disproportionate ad-based mass surveillance raises problems wherever it is deployed, but its use in the authoritarian countries named in the reporting is especially hazardous for the people being tracked.

Why it matters

The picture that emerges from the combined reporting is one of diffusion, in Christl's telling: a commercial tracking product associated first with military and intelligence work has spread outward to federal law enforcement and then downward toward state and local police. Each step in that chain widens the population that can be placed under surveillance and deepens questions about oversight and proportionality.

The ad-based design is central to why this matters. Because the system draws on the commercial advertising ecosystem rather than on dedicated spyware or interception, government tracking becomes tied to a data supply that ordinary online activity keeps feeding — a channel whose reach is set by the ad market rather than by any single agency's capabilities.

For European and UK agencies in particular, the findings land while the lawfulness of this kind of surveillance is already under debate, and the reporting supplies concrete named countries to anchor that debate. The story is also a reminder of how such procurement can be exposed at all: through open-source research, records requests and infrastructure mapping rather than leaked documents, a playbook Citizen Lab has now demonstrated against a commercial vendor and that can plausibly be repeated against others.