The customers at the far end

Everything upstream is diffuse by construction. The demand side is not. At the end of the chain sits a small number of firms selling a finished capability with a login and a map, and a growing list of customers who have signed for it, at prices that occasionally surface in a procurement record.

The finished product

Penlink, an American company, sells a tool called Webloc that reads advertising industry location data across up to 500 million devices: precise coordinates, the advertising identifiers that go with them, device metadata, and the demographics and interest categories the trade attaches to people. It shows which devices were in a given area at a given time, and follows them outward to the places they sleep. Webloc came from Cobwebs Technologies, an Israeli firm merged into Penlink in 2023, after the American investment company Spire Capital bought it. The catalogue extends past location into social media monitoring with facial recognition, a platform for running fake accounts, and one for phishing. A German sales office has been running since 2020, as Pen-Link GmbH since 2025.

The raw material is the same commodity the marketplace sells. What the vendor adds is the interface, and the interface is what turns a purchase of files into an operational capability that a duty officer can use without knowing what a bid request is.

Buying around the judge

In Germany the safeguard attaches to compulsion. The state may oblige a carrier to hand over what it holds, subject to a court, and a purchase is not compulsion. Nobody is obliged, nothing is seized, and a rule drafted for the case where data has to be prised out of somebody does not obviously bind the case where it is on sale. The state data protection commissioner for Mecklenburg-Vorpommern put it plainly: a judicial reservation would be circumvented by using commercial location data without a legal basis for it.

Two routes to the same thing, drawn side by side. On the compelled route, a police force that wants a person located makes an application to a court, which gives judicial authorisation and issues an order to the carrier that holds the data; a judge decides, and the order leaves a trace behind it. On the bought route, a police force opens an account with the bazaar, where edges 1 to 7 have already run, pays an invoice and receives a subscription with a login and a map; nobody is compelled, so nothing asks a judge anything. Both routes end at the same record of where a named person was and when. The safeguard is drafted for compulsion, and a purchase compels nobody, so the rule does not obviously bind it: one route is visible to a court and the other is visible on an expenses line.

The German picture, as of June 2026, is that two state criminal police offices have confirmed buying commercial location data, nine further states declined to say, five denied it, and none of the sixteen state data protection authorities named a concrete legal basis for the practice. A law professor in Munich who researches internal security put it in one sentence: as things stand, it would be unlawful. At federal level the case is firmer still, since the Bundestag’s research service found no authorising statute for the federal criminal police or the federal police, and the government has classified whether the purchases happen at all.

That classification does the second piece of structural work. A challenge needs somebody who can show they were affected, and secrecy about the practice removes the class of people who could ever demonstrate it. A contested legality that cannot be litigated is, for practical purposes, a settled one.

The supervisor on the customer list

A state that buys here supervises a market it also funds through its venture programmes and now depends on operationally. The incentives that follow are not mysterious. As the German reporting ran through 2024, the federal interior ministry opposed barring intelligence services from buying broker data, calling it nonsensical to restrict that protection first, and Roderich Kiesewetter, deputy chair of the parliamentary oversight committee, found it sensible to make more use of such data for intelligence work, given the threat picture and the shortage of resources. Both positions are defensible on security grounds and both convert a regulatory question into a procurement interest, which is a different sort of question with a different sort of answer. The same member of that committee later advised citizens to switch their phones off for the whole commute, and the two suggestions sit together without difficulty: one buys from the market, the other asks people to hide from it, and neither touches it.

The purchases also work as a certificate. A market that sells to interior ministries has had its product treated as procurable by the institutions best placed to call it unlawful, and each renewed licence makes restriction a decision about an existing government capability rather than about an abstract market. Austria renewed for 1.85 million euros over two years. Hungarian services, already customers of the same vendor’s other products, took Webloc licences in March 2026, weeks before a national election. The pattern in the regulatory file is familiar enough: rules arrive without the resources to enforce them, and capabilities arrive on a purchase order.

The private edge

The boundary between state and corporate customers is a sales decision rather than a technical one, and in August 2026 it moved. Webloc was pitched to LVMH through a French private security firm, as a way of investigating thefts at one of the group’s sites. The luxury house declined once it understood what was on offer. The refusal is creditable and the offer is the datum: a capability whose known users were an American immigration authority and ministries in Hungary and Austria, and no private company, was presented to a corporate loss prevention department as an ordinary procurement, which is what happens to capabilities once the price falls and the supplier needs growth.

If the next offer is accepted, little in the structure would show it. The purchase leaves no trace a regulator routinely sees, the data is bought rather than compelled, and the buyer’s use, as the marketplace maintains, is the buyer’s affair.

The clerk’s brief

From the clerks, for the Patrician’s eyes

Purchases and offers, as at August 2026 and newest first, with settled items absorbed into the customer list at the foot of the file. What the purchased data reveals is filed under the exposure heading.

August 2026: The tool is offered to a luxury house

On 11 August 2026 netzpolitik.org reported that Webloc had been presented to LVMH through Amarante, a French private security firm, as a means of investigating thefts at one of the group’s sites. LVMH stated that once Moët Hennessy understood what was proposed, it ended the discussions. A tracking researcher’s verdict was that private use of such tools is unacceptable outright. The clerks file the offer rather than the refusal, on the grounds that a sales team pitching intelligence tooling to a brand protection department has already answered the question of where the boundary is.

June 2026: Vienna renews the licence

On 30 June 2026 netzpolitik.org put the Austrian interior ministry on the customer list with a 1.85 million euro two-year extension of its Webloc licence, making Austria the second confirmed EU customer. The ministry declined to comment, citing security. A tracking researcher noted that even narrowly targeted use analyses the daily movements of millions of uninvolved people. The clerks observe that a purchase too sensitive to discuss stays legible in a procurement record, which is one of the few remaining places this market can be read from outside.

June 2026: Police buying what a warrant would otherwise cost

On 2 June 2026 netzpolitik.org found German police forces in the market. Brandenburg and Mecklenburg-Vorpommern confirmed obtaining data from commercial providers, nine further states declined to answer, five denied it, and no state data protection authority could name a legal basis. A legal scholar’s assessment was that the practice would be unlawful as things stand. The clerks have underlined the observation that a judicial reservation is circumvented by purchase: the safeguard survives on paper and is bypassed at the invoice.

April 2026: Budapest, before an election

On 10 April 2026 netzpolitik.org reported that Hungary’s national security service had taken Webloc licences in March 2026, adding location tracking to a vendor relationship that already covered social media monitoring, fake account operations and phishing tooling across three Hungarian agencies. The clerks note the timing without drawing the conclusion, and observe that a capability bought for one purpose is available for the others.

The customer list

The list divides by how each entry came to be known. Austria’s interior ministry appears in a licensing contract, and Hungary’s national security service in reporting on its procurement, alongside two other Hungarian agencies that have bought from the same vendor. Two German state criminal police offices confirmed their purchases when asked, nine further states declined to say, and the federal government has classified the question. An American immigration authority is reported as a user rather than confirmed as one. One luxury conglomerate was offered the tooling and turned it down. The tooling is the same in each case, the legal basis is contested or absent in most, and the purchases sit outside the procedures built for compelled data. The clerks note that the visible part of this market is whatever a procurement record happens to expose, and that the same capability is now being offered outside government as well as inside it.