ATF drops AdTech surveillance tool as ICE eyes commercial location data

The Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) canceled a contract for commercial cellphone location surveillance software after a bipartisan congressional inquiry revealed that the agency had run hundreds of warrantless searches through a system built on data from consumer apps and digital advertising.

The cancellation ends ATF’s use of Penlink’s Webloc platform, which turns location information gathered through consumer apps and the digital advertising ecosystem into a searchable investigative tool.

It does not, however, resolve the broader federal debate over whether agencies may buy sensitive location data that would generally require a warrant if sought directly from a cellphone carrier.

Meanwhile, Immigration and Customs Enforcement (ICE) separately has sought information from industry about commercial Big Data and advertising technology services that could support its criminal, civil, and administrative investigations, including location data platforms and large-scale analytics.

Biometric Update reported in February that ICE is surveying the commercial advertising technology market for tools capable of supplying location data and large-scale analytics to federal investigators.

During a May hearing by the House Committee on Oversight and Government Reform, Rep. Michael Cloud questioned ATF Director Robert Cekada about the agency’s purchase of AdTech software that tracks cell phone geolocation data.

Cekada acknowledged that the bureau had purchased access to advertising-derived geolocation technology.

At the time, he said, the agency had not used the system in a criminal case because it had not established policies governing such use.

ATF has not publicly explained how it drew the line. What is clear is that the platform was being used in connection with active investigations before the bureau ended the contract.

Following the hearing, Wyden’s office immediately requested a briefing from ATF.

On June 12, staff for Wyden and Cloud met directly with Cekada, who revealed that ATF purchased licenses for Webloc, and had used the tool for 341 total searches, which included 55 queries for training and demonstrations, 64 related to violent crime, and 222 tied directly to active ATF case numbers.

Webloc allows investigators to search for mobile devices present in a defined place during a particular period, using location records gathered through consumer apps and the commercial AdTech data market.

These records can include advertising identifiers, coordinates, IP-derived location information, and other data that can be linked over time to a device and, in some cases, to a person.

The attraction for law enforcement is apparent. Instead of compelling a wireless carrier to provide records through a court order, investigators can purchase access to commercially assembled location data and search it for devices that appeared near a crime scene, workplace, residence, or other location.

That distinction lies at the center of the constitutional dispute. In 2018, the Supreme Court held that police generally need a warrant to obtain historical cellphone location records from a wireless carrier.

The Court has not squarely decided whether the government may obtain comparable information by purchasing it from commercial data brokers.

ATF has said that its use of Webloc was a limited pilot and that it concluded that it did not meet the agency’s needs. ATF also said it was not using other services based on advertising-sourced data.

Wyden and Cloud said ATF additionally committed to reviewing its other vendor contracts for dependence on AdTech-derived location information.

“For years, I have warned that the government’s purchase of Americans’ location data from shady data brokers is an unacceptable end-run around the Fourth Amendment,” Wyden said. “After Representative Cloud and my staff informed the ATF about the legal and privacy quagmire surrounding AdTech data, the agency did the right thing.

“Canceling this contract is a victory for Americans’ constitutional rights, but Americans’ privacy shouldn’t depend on ad hoc congressional interventions. Congress must pass the Government Surveillance Reform Act to close the data broker loophole once and for all,” Wyden added.

The act would prohibit the federal government from purchasing Americans’ sensitive data from brokers.

“When we uncovered that the ATF was purchasing software to track Americans’ cell phone location data without a warrant, I knew that would not be the end of the conversation,” Cloud said. “I am thankful the bipartisan follow-up raised enough concern to result in the ATF canceling the contract. The Second and Fourth Amendments are not negotiable, and we will keep fighting to protect both.”

Penlink, which acquired Webloc’s original developer, Israeli company Cobwebs Technologies, said it remained proud of its longstanding relationship with ATF and expected to continue supporting the bureau’s violent crime, firearms, explosives, and arson mission.

The company’s wider customer base illustrates why ATF’s withdrawal should not be mistaken for a broader government retreat from commercial geolocation surveillance.

In March, Wyden led a bicameral coalition of 71 members of Congress in calling for a Department of Homeland Security (DHS) Inspector General (IG) investigation into ICE’s warrantless purchases of the same Penlink Webloc surveillance tool.

DHS’ IG had previously found that ICE’s data purchases were illegal, causing the program to shut down in 2023 following an investigation requested by Wyden and Senators Elizabeth Warren, Edward Markey, and Brian Schatz.

ATF’s cancellation did not settle the larger question of whether federal agencies can buy access to sensitive information that, if sought directly from a phone carrier, could require judicial oversight.

As Biometric Update reported, ICE in January said its request for information was issued to better understand how commercial big data providers and advertising technology firms might directly support investigative activities, while remaining sensitive to “regulatory constraints and privacy expectations.”

Wyden’s office said in March that “ICE has stonewalled congressional oversight of its location data purchases.” His office had requested a briefing from ICE soon after ICE issued a no-bid contract to Penlink in 2025, which included licenses for Webloc.

“In December 2025, a briefing was scheduled for February 10, 2026,” Wyden’s office said. “One day before that briefing was to take place, ICE cancelled it with no explanation and without any offer to reschedule,”

It was about that same time that ICE issued its request for information.

ICE emphasized that the request was market research rather than a solicitation or commitment to award a contract. Even so, it showed ICE was still actively examining how advertising technology and commercial data could be incorporated into investigative operations.

The ATF decision therefore represents a meaningful retreat by one agency after direct congressional scrutiny, a judicial warning, and an apparent concern about the admissibility of evidence, but does not close the commercial data loophole that made Webloc attractive in the first place.

Unless Congress or the courts establish a clear rule, the question will continue to be whether the government can buy from a data broker what it could not readily compel from a carrier without judicial approval.

Article Topics

data brokers  |  ICE - U.S. Immigration and Customs Enforcement  |  identity intelligence  |  law enforcement  |  location data  |  surveillance  |  U.S. Government