8 min read
Most people assume that if they are not under formal investigation, their location stays private. A Bloomberg investigation published on 5 November 2026 suggests otherwise. According to the report, law enforcement agencies in the UK, the Netherlands, Germany, Austria, and Hungary are using a surveillance system called Webloc, built by US company Penlink, to access billions of smartphone location data points on a near real-time basis—without obtaining a warrant.
The mechanism is straightforward and that is precisely what makes it significant. Webloc does not intercept communications. It buys location data that apps on your phone have already collected and sold through advertising networks and data brokers. Because the data is commercially available, purchasing it sidesteps the legal thresholds that govern traditional surveillance. The Citizen Lab has previously reported that Webloc had processed data associated with up to 500 million mobile devices globally.
This article explains how the system works, which apps feed it, and what it means practically for anyone who relies on a VPN to protect their privacy—because a VPN solves only part of the problem here.
What Webloc Actually Does
Webloc is best understood as a data aggregation and querying tool rather than a traditional interception system. Law enforcement analysts feed it a device identifier, a phone number, or even a home address, and the system returns a detailed history of where that device has been—drawn from location data purchased through the commercial ad-data ecosystem.
The data itself originates from advertising software development kits (SDKs) embedded in ordinary smartphone apps: weather apps, games, navigation tools, coupon apps, and many others. These SDKs collect GPS coordinates, device identifiers, and sometimes IP addresses, then pass that data upstream to ad networks and data brokers. Brokers aggregate and resell it. Webloc sits at the end of that chain, giving analysts a search interface over what is effectively a mass-surveillance dataset built from everyday app usage.
Importantly, the Bloomberg report notes that Webloc can also infer location from IP addresses and cross-reference device data against home addresses and workplaces to identify individuals. That last step—identity linkage—is what turns a pile of anonymous-seeming coordinates into actionable intelligence about a specific person.
Why No Warrant Is Required
The legal reasoning is uncomfortable but not complicated. In most jurisdictions, a warrant is required to compel a third party to hand over private communications or records. But data that has been voluntarily shared with an advertiser—even if most users have no idea this is happening—has been treated by courts and regulators as commercial data rather than protected personal information.
This is sometimes called the third-party doctrine: once you share information with another party (even buried in a 4,000-word privacy policy you never read), you lose certain legal protections over it. Law enforcement agencies can then purchase that data through the same commercial channels available to any company, without triggering warrant requirements.
The UK's existing surveillance framework, including the Investigatory Powers Act 2016, governs interception and certain data requests to service providers. It does not straightforwardly cover a police force buying a subscription to a commercial data broker's product. That gap is exactly what systems like Webloc exploit.
Which Apps Feed This Data Pipeline
No single app is the culprit. The ad-data supply chain is structural. Any app that integrates a third-party advertising SDK and requests location permissions contributes to it. Commonly implicated categories include:
- Weather and navigation apps that need location to function
- Free games that monetise through targeted advertising
- Retail, coupon, and loyalty apps
- Some news and media apps that serve personalised ads
- Utility apps (torch, calculator, file manager) bundled with ad SDKs
The SDKs involved are rarely from the app developer themselves. They are third-party components that developers add to generate advertising revenue. The developer may not fully understand what data those SDKs collect or where it goes. Users almost certainly do not.
Critically, this affects both Android and iOS devices. Apple's App Tracking Transparency framework, introduced in 2021, reduced the volume of third-party tracking on iOS but did not eliminate it. Apps can still collect location data for their own stated purposes and share it downstream in ways that are technically within their privacy policies.
What a VPN Does and Does Not Protect Here
A VPN masks your IP address and encrypts your internet traffic between your device and the VPN server. That is genuinely valuable—it prevents your internet service provider from logging your browsing, stops network-level eavesdropping, and hides your real IP from websites and services you connect to.
But it does not remove your device from the ad-data supply chain that feeds Webloc. Here is why:
- GPS and sensor data are collected at the app level, before your traffic ever reaches the VPN tunnel. An app with location permission reads your coordinates directly from the device hardware. The VPN sees none of this.
- Device identifiers persist regardless of IP. Advertising identifiers—the Google Advertising ID on Android, or the Identifier for Advertisers on iOS—are tied to your device, not your network connection. A VPN changes your IP; it does not change these identifiers.
- Webloc can infer location from IP addresses, according to the Bloomberg report, but that is one input among many. Even with a VPN masking your real IP, your GPS-derived coordinates may already be in the dataset.
None of this means a VPN is useless—far from it. It addresses a real and separate category of threat. But it is not a complete answer to ad-data surveillance, and it is worth being clear about that distinction. You can read more about what a VPN actually does on our what is a VPN page, and our IP leak test can confirm whether your VPN connection is functioning as expected.
What You Can Actually Do About It
Reducing your exposure to ad-data surveillance requires action at the app and device level, not just the network level. The following steps are practical and do not require technical expertise.
Audit and restrict app permissions
On both Android and iOS, you can review which apps have access to your location and change permissions to While Using or Never. Apps that have no genuine need for your location—games, utilities, retail apps—should be denied it outright. This reduces the GPS data flowing into ad SDKs in the first place.
Reset or limit your advertising identifier
On iOS, go to Settings > Privacy & Security > Tracking and disable Allow Apps to Request to Track. You can also reset your Identifier for Advertisers periodically. On Android, go to Settings > Privacy > Ads and opt out of personalised ads or reset your advertising ID. Neither option is a complete solution, but both reduce the linkability of your data across data brokers.
Be selective about what you install
Free apps monetised through advertising are the primary vector. Paid apps, or apps from developers with explicit no-tracking policies, carry lower risk. This is not a universal rule—some paid apps still include ad SDKs—but it is a reasonable starting heuristic.
Use a VPN for what it is good at
A VPN remains worth using. It prevents network-level surveillance, protects you on public Wi-Fi, and stops your ISP from building a profile of your browsing habits. If you are on a restrictive network—at work, in a country that filters internet traffic—it also matters for access. PremierVPN's apps for iOS and Android use WireGuard by default for performance, with WireGuard Stealth and VLESS+REALITY available for networks that actively block VPN traffic. Our no-logs policy means we do not retain records of what you do while connected.
Consider a browser extension for web tracking
Much ad-data collection also happens through web browsers. PremierVPN Protect, our free browser extension, blocks trackers and ads at the browser level, reducing the data that ad networks collect about your web behaviour.
The Broader Pattern
The Webloc story is not an isolated incident. It reflects a wider shift in how surveillance works. Traditional interception—tapping calls, reading messages—requires legal authority because it involves compelling a service provider to hand over private data. Purchasing commercially available data requires no such authority, because the legal fiction holds that the data was voluntarily shared.
This creates an asymmetry: privacy law has not kept pace with the data economy. Regulators in Europe are beginning to scrutinise whether this commercial data trade is compatible with GDPR obligations—the data being sold was collected under consent frameworks that most users never meaningfully agreed to. But those regulatory processes move slowly, and in the meantime the data market continues to operate.
What the Bloomberg investigation makes clear is that the consequences of this market are not abstract. The data your weather app collected last Tuesday is, in principle, accessible to a law enforcement analyst today, without a judge's signature.
Summary
The Penlink Webloc story is a concrete illustration of a gap that privacy-conscious users often miss. Hiding your IP address is one layer of protection, and a worthwhile one. But the ad-data pipeline that feeds systems like Webloc operates at the app level, using GPS coordinates and device identifiers that exist independently of your network connection. A VPN does not touch that layer.
The practical response is layered: restrict location permissions aggressively, limit your advertising identifier, be thoughtful about which apps you install, and use a VPN for the network-level protections it genuinely provides. No single tool covers everything—but understanding what each tool actually does lets you make better decisions about where the real gaps in your privacy are.
