Your weather app is telling the government where you are, where you've been, and where you sleep.
In recent reporting, Bloomberg and Citizen Lab have identified that Penlink, an "American surveillance company," is selling location information to governments and law enforcement agencies worldwide.
Penlink's Webloc software reconstructs the movements of hundreds of millions of phones based on location data flowing through the advertising ecosystem. Webloc allows clients to see all of the phones that were in a particular area at a specific time, with historical data going back 12 months, then follow those phones home.
Developers told Bloomberg they had no relationship with Penlink and did not know their users' data was being used for surveillance.
What do you mean, you didn't know?
How an SDK works
An SDK is a piece of code you did not write that does some task. In this case, that task is ad delivery. You embed the SDK into your app, the SDK shows ads, and you get paid. Everyone in mobile development knows that.
Start.io works directly with app developers, offering them a chance to make money by embedding Start.io's SDKs inside their apps. Start.io has placed its SDKs in more than 500,000 apps that have collectively been downloaded more than 25 billion times.
Their own marketing says their SDK can reach 2.4 billion devices globally, including 300 million in the US alone. They also claim to analyze over 100 billion first party mobile signals daily (i.e. location) and connect developers to real time bidding.
Location history reveals where a person sleeps, where they work, where their children go to school, where they worship, where they see a doctor, where they meet a lawyer.
Real time bidding is another way to say ad-auctions. When an ad space opens in an app, an automated auction takes place in milliseconds that allows companies to bid on the ad-space on your phone. The bid request can include a device advertising ID (linked to interests, hobbies, and other personal information), GPS coordinates, IP address, device details, and the app being used. That information is broadcast to many potential ad buyers and intermediaries. Participants can collect bid data even if they do not win the auction.
The SDK exists to provide information about your user to an ad auction, so the auction can decide who will pay the most to show that user an ad. So, for a developer to say they didn't know where their users' data was going to end up is nothing more than a cop out.
I believe they did not know the name Penlink. I do not believe they didn't know how an SDK works or that they were exposing their users to third-party data brokers. Simply put, when you put a location collecting ad SDK in your app, you are putting your users' location into a market that sells location, and one of the buyers is the government.
Who buys it
Penlink says Webloc is sold to law enforcement and national security agencies. Penlink says it does not supply US location data to foreign governments. Penlink says its data partners obtain user consent and filter sensitive locations.
The customer list, as reported by Citizen Lab and by Bloomberg, includes US Immigration and Customs Enforcement, which has spent millions on related contracts, branches of the US military, and more than a dozen American police departments, among them agencies in Los Angeles, Dallas, Baltimore, and Tucson. Internationally it has been acquired by authorities in the United Kingdom, Saudi Arabia, the United Arab Emirates, Singapore, the Netherlands, Germany, Austria, and Hungary. Citizen Lab found indications it has been used to track people in Germany, Austria, Italy, Romania, the United Arab Emirates, Israel, Singapore, and Russia.
If the government needs location data, it should need a warrant.
In Tucson, internal records obtained by the Electronic Frontier Foundation showed the department used Webloc to identify suspects in thefts and burglaries and in the abduction of a University of Arizona student. Company materials and training sessions have also illustrated the tool's use against pro-Palestinian protesters, suspected Iranian spies, Serbian militia groups, and members of motorcycle gangs.
The ACLU reported that ICE signed a 2.3 million dollar contract in the fall of 2025 with Penlink for access to surveillance tools including Webloc. That contract will payout millions for a tool that lets a user (a government employee) search mobile phone location data and track devices over time.
Location history is not neutral, it reveals where a person sleeps, where they work, where their children go to school, where they worship, where they see a doctor, where they meet a lawyer. For some, those places are not just private, they are the places where enforcement officers or people who mean them harm can find them.
Draw a box around a church on a Sunday morning, a workplace at 6 a.m., a shelter, or clinic, go back 12 months, see every phone that was there, and follow those phones home. This is what Webloc was built to do, dragnet searches for every device present in a given area, then produce histories for the devices it finds.
Despite having more than 100 million downloads between the two apps, AccuWeather and Muslim Pro's developers told Bloomberg they had no relationship with Penlink and were unaware their users' data could end up in Webloc. This negligence fails to address that a prayer app's location data is not just location data, it is religious practice, community, and routine attached to coordinates. If you embed an ad SDK in a prayer app, you are inputting religious beliefs into the ad auction.
"I did not know," is unacceptable.
Performative consent
The consent chain here is performative and designed to put friction between the user and their privacy.
A user taps Allow location so a weather app can tell them if it will rain, they did not tap Allow location so ICE can see where they live. A developer embeds an SDK so an app can show ads and make money. In most cases, they have not reviewed the SDK's data sharing terms or traced where the data goes, which is where the faux pas occurs.
It should be their responsibility to understand that he SDK sends data to a broker, the broker sells it to Penlink, and Penlink sells access to enforcement agencies. At no step does anyone ask the user if they are comfortable with that level of visibility.
Penlink says its data partners obtain user consent. That is true in the narrowest sense, and false in the only sense that matters. A person who consented to a weather forecast should not also have to consent to a 12 month location history, available by warrantless search to the government.
In 2018, the Supreme Court decided Carpenter v. United States, and required a warrant for location data obtained from telecom carriers. The Justice Department has argued that data purchased from commercial sources falls outside that requirement.
That all to say, the government can buy your data from the ad market.
That is why the developers' line matters so much. If the developer does not know, the user cannot know. If the user cannot know, they cannot consent.
What the developers actually did
I want to be fair to developers here.
Many developers are on small teams, or are solo developers, trying to make a free app pay for itself. SDK documentation is long, dense, and data sharing terms are often buried. SDKs are presented to these teams and devs as a way to monetize their hard work, and it can be integrated in a day.
That is exactly the problem, the system is designed so that no one has to know:
- The developer gets revenue without knowing the buyer.
- The broker gets data without knowing the user.
- The government gets location without a warrant.
- The user gets a free app, and pays with their location history.
Ignorance is not an accident in this case, it is instilled because SDKs wouldn't be profitable if it were easy for users to opt-out. If every user had to know, they would say no, pay for the app, or delete it.
So yes, they do not understand SDKs. Or more precisely, they understand SDKs as a way to show ads, not as a way to sell location–which as a mobile developer is 100% your responsibility. When you can outsource data to a third party and then claim ignorance when the third party sells it to a fourth, that is a failure of the profession, not of individual developers.
A way forward
For users, here are some concrete fixes, though they do not eliminate all exposures:
- Set location to While Using, not Always.
- Reset your advertising ID.
- Uninstall free apps you rarely use.
- Prefer apps with fewer or no ad SDKs.
These steps reduce the amount and quality of collected data, they do not fix the underlying problem.
If you're a developer...
- Inventory every SDK in your app, by name, and publish a public list.
- Read what each SDK collects, where it sends it, and how long it is retained.
- Make UI/UX choices driven by informed consent.
- Remove location collecting ad SDKs from apps that do not need location to work OR
- Remove SDKs entirely and charge for the app OR
- Use a paid, non tracking ad network.
- Test your own app with a network capture.
Yes, it is extra work, but really it is just the job. If you ship software to a hundred million people, as Muslim Pro did, you do not get to say you did not know what the code inside your software does. Scale is not an excuse for ignorance.
Regulations
To see real change, regulations need to be passed that close the purchase loophole. If the government needs location data, it should need a warrant, always.
Globally, we need to ban the sale of precise location data to government agencies without judicial authorization, require developers to disclose, in plain language, every SDK in their app and every category of data that SDK collects, and require brokers to disclose every buyer. We already require these steps for other types of sensitive data, in other contexts.
The SDK may not have deported anyone itself, but it did provide a vehicle for others to.
