ICE Tracks Phones Without Warrants

A tool called Webloc turns your apps into immigration surveillance.

State of Surveillance

Smartphone displaying a map with location pins on a dark surface
Photo via Unsplash

Last updated: October 21, 2026. What changed: Three developments since January 2026 turned the Webloc story from a single-contract story into a global surveillance story. On March 3, 2026 Senator Wyden, Rep. Espaillat, and 70 other Democrats demanded an investigation into ICE and DHS warrantless location data purchases. On April 9, 2026 the University of Toronto's Citizen Lab published a technical investigation estimating Webloc's ad-data pipeline tracks up to 500 million phones and feeds ICE, U.S. military, police departments, and Hungary's intelligence service. On June 29, 2026 the U.S. Supreme Court ruled 6-3 in Chatrie v. United States that geofence warrants are Fourth Amendment searches, putting the warrantless data-broker workaround Justice Gorsuch called "personal property" on shakier constitutional ground.

Update (October 21, 2026)

The warrantless Webloc story has developed significantly in the ten months since this article first published.

On March 3, 2026 Senator Ron Wyden and Representative Adriano Espaillat, joined by 70 other Democrats, delivered a letter to Department of Homeland Security Inspector General Joseph Cuffari calling on him to open an investigation into ICE and DHS warrantless purchases of Americans' location data.[9][10] The letter names Penlink, the vendor behind Webloc, calling it a data broker likely violating federal law, and asks the inspector general to determine whether ICE and DHS purchase illegally obtained location data, how that data is used, and whether DHS ignored a 2023 inspector-general recommendation on commercial location-data policy.[9] At a Senate hearing the following week, Wyden asked FBI director Kash Patel whether the FBI would commit to not buying Americans' location data. Patel declined, saying the FBI "uses all tools."[11]

On April 9, 2026 the University of Toronto's Citizen Lab published a technical investigation of Webloc estimating that the system draws location records on up to 500 million mobile devices from ad exchanges and app SDKs, then answers geofence queries on demand.[12] The report says customers can search roughly three years of historical device data and identifies ICE, the U.S. military, multiple police departments, Hungary's domestic-intelligence agencies, and El Salvador's National Civil Police as customers, layering the U.S. immigration-enforcement deployment onto a global commercial market. See the Citizen Lab Webloc exposé for the technical detail.

On June 29, 2026 the Supreme Court ruled 6-3 in Chatrie v. United States, No. 25-112, that the government's use of a geofence warrant to obtain Google Location History data constitutes a Fourth Amendment search.[13] Justice Kagan wrote the majority opinion. Justice Gorsuch concurred in the judgment and called the location data on a smartphone the user's "personal property," squarely within the Fourth Amendment's "effects." Justice Jackson concurred, and Justices Alito, Thomas, and Barrett dissented in part. The Court decided only that a search occurred, leaving the Fourth Circuit to decide whether each stage of the warrant satisfied the particularity and probable-cause requirements. See the Chatrie ruling analysis for the doctrinal breakdown, and the 70-lawmakers letter coverage for the congressional-oversight track.

Practical implications through October 21, 2026: Penlink contracts remain in place and ICE has continued acquiring ad-data-derived location streams, but the warrantless-purchase theory that legitimated Webloc-style surveillance is now constitutionally weaker than it was when this article first published.

TL;DR: Immigration and Customs Enforcement (ICE) is using a surveillance tool called "Webloc" to track the location of millions of mobile phones, without a warrant. Webloc collects billions of location signals daily from data brokers who obtain it from apps on your phone. ICE agents can trace anyone's movements over time, identify home addresses from work locations, geofence specific areas, and build comprehensive movement profiles. The government argues it doesn't need a warrant because you "voluntarily" shared your location with apps. Legal experts call it a Fourth Amendment bypass. ICE promised to stop buying location data in 2024. They didn't.

What Is Webloc?

Webloc is a phone surveillance tool sold by Penlink, a company that acquired the Israeli surveillance firm Cobwebs Technologies in 2023. ICE has spent millions on Penlink's suite of surveillance products.[1]

Here's how it works:

  1. Apps on your phone collect location data: Games, weather apps, shopping apps, navigation tools. Most people grant location access without thinking.
  2. That data flows to mobile advertising brokers: Companies aggregate billions of location "pings" daily from hundreds of millions of devices.
  3. Webloc buys access to this data: Then provides ICE agents with a searchable database of movements.
  4. ICE tracks without a warrant: No judge, no probable cause, no oversight.

The system can filter by advertising identifiers (like Apple's IDFA or Google's AAID), GPS coordinates, Wi-Fi signals, or IP addresses. It tracks how many days a device visited a location and average time spent there.[2]

What ICE Can Do With Webloc

Trace Home Addresses

See where a phone sleeps at night. Identify family members by co-located devices. Map social networks through physical proximity.

Track Movement History

Visualize months or years of someone's path through the world. Workplaces. Churches. Clinics. Everywhere they've been.

Geofencing Operations

Draw a box around any location: a workplace, a protest, a community center. See every phone that was ever there.

Pattern Analysis

Identify daily routines. Predict future locations. Know where someone will be before they get there.

Webloc integrates with another Penlink tool called "Tangles" for social media monitoring. ICE can correlate your physical movements with your online posts. Your tweet from a coffee shop? They know you were there.[3]

The "Data Broker Loophole"

Here's the legal sleight of hand: The Supreme Court ruled in Carpenter v. United States (2018) that tracking someone's phone location requires a warrant. That was a victory for the Fourth Amendment.

But the government found a workaround.

Instead of tracking phones directly, agencies buy the same data from commercial brokers. Their argument: You "voluntarily" shared your location with apps, so you have no expectation of privacy in that data. The third-party doctrine says information shared with third parties loses constitutional protection.[4]

Civil liberties groups call this a "data broker loophole": the government buying what it couldn't legally seize. The data is identical. The surveillance is identical. But paying a company for it supposedly makes it constitutional.

Senator Ron Wyden has called this "warrantless surveillance by credit card."[5]

ICE Promised to Stop. They Didn't.

In January 2024, the DHS Inspector General reported that ICE's purchase of commercial location data violated privacy policies and lacked proper legal safeguards. ICE pledged to stop buying telemetry data.[6]

They reversed course.

Public procurement records show ICE continues spending millions on Penlink surveillance tools, including Webloc. Contracts were renewed. New capabilities were added. The pledge was abandoned.[1][7]

This pattern repeats across government surveillance: Promise reform after public outcry. Wait for attention to fade. Resume surveillance.

Who Gets Tracked?

Webloc casts a wide net. Everyone with apps that share location data is in the database. That's most smartphone users in America.

But the targeting is specific:

  • Immigrant communities: ICE's primary mission. Location data helps identify workplaces, residences, and movement patterns for enforcement.
  • Activists and organizers: Geofencing protests, community meetings, and advocacy events creates lists of participants.
  • Religious communities: Location data reveals church attendance, mosque visits, and religious practice patterns.
  • Healthcare visits: Tracking phones at clinics exposes sensitive medical information without touching medical records.

The potential for abuse is staggering. A tool designed for immigration enforcement can target anyone in the database, which is nearly everyone.

The Companies Making This Possible

Penlink

Originally a telecommunications analysis company, Penlink acquired Cobwebs Technologies (an Israeli intelligence firm) in 2023. They now offer a complete surveillance package: phone tracking, social media monitoring, and data analytics. ICE is a major customer.[1]

Mobile Data Brokers

Webloc doesn't collect location data directly. It aggregates from brokers who collect from apps. Those brokers include familiar names like Gravy Analytics (now banned from selling sensitive location data by the FTC, but still operating) and dozens of smaller companies in the advertising ecosystem.[8]

App Developers

Every app that requests location access and monetizes through advertising is potentially feeding this system. Most developers don't know (or don't care) where their users' data ends up.

What You Can Do

Audit Location Permissions

Review every app on your phone. Most don't need location access. Revoke permissions aggressively. Settings → Privacy → Location Services.

Disable Advertising ID

iPhone: Settings → Privacy → Tracking → Turn off "Allow Apps to Request to Track"
Android: Settings → Privacy → Ads → Delete advertising ID

Use a VPN

A VPN masks your IP address, making IP-based location tracking less effective. Won't help with GPS, but removes one tracking vector.

Leave Your Phone Behind

For sensitive activities (protests, community organizing, legal consultations), consider leaving your phone at home or using a burner.

Demand Legal Reform

The Fourth is Not for Sale Act would require warrants for government purchase of location data. Support organizations pushing for passage.

Use Privacy-Focused Alternatives

GrapheneOS (Android). Signal (messaging). DuckDuckGo (browser). Apps that don't track by design.

The Bigger Picture

Webloc is one tool in ICE's expanding surveillance arsenal. They also use:

  • Clearview AI: Facial recognition from billions of scraped photos
  • Palantir ImmigrationOS: AI platform for targeting and tracking deportation candidates
  • Flock Safety cameras: License plate readers across thousands of neighborhoods
  • Thomson Reuters CLEAR: Database aggregating utility bills, credit reports, and vehicle records

Each tool alone is concerning. Together, they create a surveillance infrastructure where any identifier (your face, your car, your phone, your address) becomes a key to tracking your entire life.

The Fourth Amendment was supposed to protect against exactly this. But when the government can simply buy surveillance data, constitutional protections become optional.

Your phone is a tracking device. The question isn't whether the government can access your location. It's whether anyone will stop them.

References

  1. 404 Media - ICE Has New Tool to Track Phones Without Warrant (2025)
  2. EFF - ICE Surveillance Arsenal Expands (January 2025)
  3. Brennan Center - ICE Surveillance Programs Analysis (2025)
  4. Supreme Court - Carpenter v. United States (2018)
  5. Senator Wyden - Fourth Amendment Is Not For Sale Act
  6. DHS OIG - ICE Commercial Location Data Report (2024)
  7. WOLA - ICE Surveillance Technology Analysis (2025)
  8. FTC - Action Against Gravy Analytics (December 2024)
  9. Senator Ron Wyden. "Wyden, Espaillat and 70 Democrats Call for Investigation of ICE, DHS Warrantless Purchases of Americans' Location Data." March 3, 2026. Oversight letter from Wyden, Espaillat and 70 other Democrats to DHS Inspector General Joseph Cuffari, naming Penlink and demanding an investigation of warrantless location data purchases.
  10. Senator Alex Padilla. "Padilla, Schiff Join Wyden, Espaillat, Colleagues to Call for Investigation of ICE, DHS' Warrantless Purchases of Americans' Location Data." March 4, 2026. Senate-side announcement of the multi-signatory oversight letter to the DHS Inspector General.
  11. NPR. "Your data is everywhere. The government is buying it without a warrant." March 25, 2026. Reports Wyden's question to FBI director Kash Patel about whether the FBI would commit to not buying Americans' location data.
  12. Citizen Lab, University of Toronto. "Uncovering Webloc: An Analysis of Penlink's Ad-based Geolocation Surveillance Tech." April 9, 2026. Technical investigation estimating Webloc's ad-data pipeline reaches up to 500 million devices and naming ICE, the U.S. military, police departments, Hungarian domestic intelligence, and El Salvador's National Civil Police as customers.
  13. Supreme Court of the United States. "Chatrie v. United States," No. 25-112, slip op. (June 29, 2026). 6-3 decision holding that a geofence warrant to obtain Google Location History data is a Fourth Amendment search; opinion by Justice Kagan, with Gorsuch concurring in the judgment on personal-property grounds, Jackson concurring, and Alito dissenting in part.