TL;DR: Hungarians are voting today in parliamentary elections that could end Viktor Orbán’s 16-year grip on power. Weeks before ballots opened, his intelligence service quietly renewed licenses for Webloc, a mass surveillance system that tracks hundreds of millions of phones through advertising data. Hungary is the first confirmed EU country to deploy the tool. The EU’s response to this open GDPR violation? Nothing. Not a fine. Not an investigation. Not even a press release. The bloc built the world’s strongest privacy law and can’t stop its own member state from spying on its citizens.
Six Licenses, Six Weeks Before an Election
In March 2026, Hungary’s Special Service for National Security (NBSZ) completed a fresh round of license renewals for products made by Cobwebs Technologies, now owned by U.S. surveillance firm Penlink [1].
The shopping list, according to procurement documents reviewed by VSquare [1]:
- Tangles (web scraping and social media surveillance): dozens of licenses
- CoAnalyst (data analytics): nearly two dozen licenses
- Webloc (ad-based geolocation tracking): six licenses
- Full AI package: fewer than 10 licenses
- Blockchain analysis module: a few licenses
Six Webloc workstations. That’s six screens where Hungarian intelligence officers can type in a phone number, draw a box on a map, and watch the dots move. Where someone slept. Where they went. Who they met. Three years of history, searchable in seconds [2].
The NBSZ distributed the tools to partner agencies across Hungary’s intelligence and law enforcement apparatus [1]. And they did it weeks before the most consequential Hungarian election in a generation.
Election Day Under a Surveillance Cloud
Today’s election pits Orbán’s Fidesz party against Péter Magyar’s Tisza Party. Independent polls show Tisza leading by 10 to 13 points [3]. After 16 years of increasingly authoritarian rule, Orbán could actually lose.
The surveillance context makes this more than a normal election.
Magyar has accused Hungarian intelligence of spying on his campaign. In February, he warned the government was trying to damage him with a secretly recorded sex tape [4]. And it’s not just opposition leaders at risk: VSquare’s sources said the Cobwebs tools “could also serve purposes beyond legitimate national security work, including the monitoring of opposition figures and journalists” [1].
We don’t have proof that Webloc was used to track opposition candidates. But we know a government with a documented history of surveilling journalists and political opponents just renewed its phone-tracking licenses right before a tight election. Draw your own conclusions.
This Isn’t Orbán’s First Surveillance Scandal
Hungary has been here before.
In 2021, the Pegasus Project revealed that Hungary’s government purchased NSO Group’s military-grade Pegasus spyware for approximately €6 million through intermediaries in 2017. Confirmed targets included journalists, media owners, government critics, and opposition politicians [5].
Szabolcs Panyi, an investigative journalist with Direkt36 and VSquare, was among five Hungarian journalists targeted by Pegasus between 2018 and 2019 [6]. Here’s the twist: Panyi is one of the journalists who helped expose the Webloc procurement. And in March 2026 (weeks before this election) the Orbán government filed espionage charges against him [7].
The charges? Panyi allegedly shared Foreign Minister Péter Szijjártó’s phone number with an EU intelligence service. Panyi called it “virtually unprecedented in the 21st century for an EU Member State. This is typical of Putin’s Russia, Belarus, and similar regimes” [7].
So the timeline is: spy on journalist with Pegasus, journalist exposes your surveillance tools, charge journalist with espionage. That’s not a democracy. That’s a playbook.
VSquare also reported that Hungary is developing successor spyware to Pegasus, capable of “zero-click” attacks that require no user interaction, after an earlier homegrown system called Quvasz failed due to technical limitations [1].
GDPR: The World’s Strongest Privacy Law on Paper
The General Data Protection Regulation is supposed to prevent exactly this. GDPR’s Article 5 requires lawful, fair, and transparent data processing. Article 9 restricts processing of sensitive data including political opinions. The regulation gives EU data protection authorities the power to impose fines of up to 4% of annual turnover.
Hungary’s NAIH (National Authority for Data Protection and Freedom of Information) is the body responsible for enforcing GDPR domestically. Their track record on government surveillance? A series of “nothing to see here” conclusions [5].
After the Pegasus revelations in 2021, Hungary’s government acknowledged it purchased the spyware but claimed all surveillance was conducted “in accordance with Hungarian law” [5]. When the European Parliament’s PEGA inquiry committee investigated spyware abuse across member states, Budapest said the EU had “no mandate” to investigate because national security is a national competence [5].
Translation: we can spy on whoever we want, and you can’t stop us.
Webloc makes it worse. Pegasus at least required targeting individual devices. Webloc is mass surveillance by default: it harvests advertising data from hundreds of millions of phones simultaneously [2]. The data flows from consumer apps through ad exchanges to Penlink’s servers, then to any government customer who pays. No warrant. No court order. Just a purchase order routed through a broker company called SCI-Network Ltd., which marked up Israeli license costs by as much as 300% [1].
Hungary is the first confirmed EU member state to deploy Webloc [1]. There could be others. Citizen Lab sent 96 freedom-of-information requests across 14 European countries and six EU bodies. Europol confirmed it held Webloc-related information but refused to release it. The UK Home Office declined to confirm or deny. Thirty-nine UK police departments neither confirmed nor denied [2].
Follow the Money: 300% Markup on Surveillance
The procurement documents reveal something else: the middlemen are getting rich.
SCI-Network Ltd., a Hungarian broker company headed by Tamás Berki (who reportedly has close ties to Antal Rogán, head of the Prime Minister’s Cabinet Office) handled the Cobwebs purchases [1].
The markup? Up to 300% on Israeli license costs [1]. So Hungarian taxpayers aren’t just funding their own surveillance. They’re paying triple the actual price, with the difference flowing to government-connected intermediaries.
This is the same pattern visible across surveillance procurement globally. The technology costs are almost secondary to the relationship costs: the brokers, the lobbyists, the consultants who sit between the spy tool vendor and the government buyer.
Hungary Isn’t Alone
Citizen Lab confirmed two international Webloc customers outside the United States [2]:
- Hungary’s NBSZ: six licenses, operational since at least 2022
- El Salvador’s National Civil Police: purchased in 2021
One is an EU member state with elections today. The other is the country where President Nayib Bukele declared a permanent state of emergency and suspended constitutional rights. Both are buying the same phone-tracking tool from the same company.
That’s the company you’re keeping, Brussels.
What Happens After Today
If Magyar’s Tisza Party wins, it could mean real accountability. New government, new investigations, potential disclosure of who was tracked and why. EU leaders have been restricting classified information from Hungary due to suspected intelligence leaks to Russia [1]. A new government could change that calculus.
If Orbán survives, expect the surveillance apparatus to expand. The Pegasus successor is in development. Webloc licenses just got renewed. And Hungary has demonstrated that GDPR enforcement is a paper tiger when a member state decides its “national security” trumps everyone’s privacy.
Either way, the bigger question remains: why does the EU allow this?
Brussels can freeze billions in funding over judicial independence concerns. It can sanction countries for democratic backsliding. But when a member state deploys mass surveillance against its own citizens using commercially acquired data, violating the regulation the EU spent years crafting, the response is silence.
What You Can Do
- Reset your advertising ID: On iPhone: Settings → Privacy & Security → Tracking → toggle off “Allow Apps to Request to Track.” On Android: Settings → Privacy → Ads → Delete advertising ID. This cuts off the primary data feed that Webloc exploits
- Audit app permissions: Any app with location access can contribute data to this pipeline. Revoke location access from apps that don’t need it
- Use an ad blocker: No ad request means no location broadcast through the RTB system
- Consider privacy-focused phone OSes: GrapheneOS and CalyxOS strip out advertising infrastructure
- If you’re in Hungary: Watch for election results tonight and what the winning party says about surveillance oversight. Demand answers about who was tracked
References
- VSquare: Orbán’s Spying Kit Revealed: Israeli Surveillance Tool Combined with Hungarian Technology (April 2026)
- Citizen Lab: Uncovering Webloc: An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech (April 2026)
- Al Jazeera: Hungary’s Viktor Orbán Struggling for Political Survival Ahead of Vote (April 2026)
- Daily News Hungary: Hungarian Government Failed to Disrupt Tisza Party with Spy-Software (April 2026)
- Committee to Protect Journalists: Hungarian Journalists Targeted by Spyware Have Little Hope EU Can Help (October 2022)
- Committee to Protect Journalists: Hungary’s Szabolcs Panyi on How Pegasus Surveillance Has Hindered His Reporting (December 2021)
- Committee to Protect Journalists: Hungary Files Espionage Charges Against Investigative Journalist Szabolcs Panyi (April 2026)
- UNITED24 Media: Hungary Deploys Israeli Webloc Surveillance Tool, Violating EU Privacy Regulations (April 2026)
Published: April 12, 2026