It Is Time to Ban the Sale of Precise Geolocation

What Citizen Lab found

A new Lawfare column highlights a Citizen Lab deep dive into Webloc, a commercial adtech surveillance product, and argues the United States needs to clamp down on the collection and sale of precise geolocation. It has been reported that a leaked technical proposal obtained by Citizen Lab says Webloc can access records from “up to 500 million mobile devices across the globe,” including device identifiers, location coordinates, and profile data drawn from mobile apps and digital advertising. Webloc was developed by Cobweb Technologies and, it has been reported, is now sold by U.S. firm Penlink after a 2023 merger.

How the tool is used — and why it feels creepy

Citizen Lab’s reporting describes granular use cases that land like a gut punch. One man in Abu Dhabi was allegedly tracked up to 12 times a day via GPS or nearby Wi‑Fi; another example allegedly pinpoints two devices in exact areas of Romania and Italy at specified times. In a less exotic but no less telling vignette, a Tucson police report says Webloc helped investigators map a device present at multiple cigarette store robberies back to a suspect—who, as it turned out, was close to the first victim. Creepy? You bet.

Who's buying it, and the legal problem

It has been reported that the customer list includes U.S. federal and state agencies: the Department of Homeland Security, Immigration and Customs Enforcement, units within the military, the Bureau of Indian Affairs Police, and multiple local police departments in California, Texas, New York, and Arizona. Webloc is an add‑on to Penlink’s Tangles platform, which aggregates public web and social data; combined, the tools can allegedly join otherwise anonymous mobile identifiers to social media accounts without a warrant, creating a powerful profile-building capability that raises obvious civil‑liberties alarms.

So what now?

Tom Uren’s Lawfare piece makes the blunt case: sellable, high‑precision location data is a national‑security and privacy nightmare, and it is time to ban its commercial sale. Do we want a market where anyone’s real‑time whereabouts are a commodity? If lawmakers and regulators don’t act, the adtech economy will keep outpacing the law—welcome to the adtech version of Big Brother, only with better targeting and worse oversight.

Sources: lawfaremedia.org, Hacker News