The customers at the far end

Everything upstream is diffuse by construction. The demand side is not. At the end of the chain sits a small number of firms selling a finished capability with a login and a map, and a growing list of customers who have signed for it, at prices that occasionally surface in a procurement record.

The clerk’s brief

From the clerks, for the Patrician’s eyes

Purchases and offers, as at August 2026 and newest first, with settled items entered on the customer list at the foot of the file. What the purchased data reveals is filed under the exposure heading.

August 2026: The tool is offered to a luxury house

On 11 August 2026 netzpolitik.org reported that Webloc had been presented to LVMH through Amarante, a French private security firm, as a means of investigating thefts at one of the group’s sites. LVMH stated that once Moët Hennessy understood what was proposed, it ended the discussions. A tracking researcher’s verdict was that private use of such tools is unacceptable outright. The clerks file the offer rather than the refusal, on the grounds that a sales team pitching intelligence tooling to a brand protection department has already answered the question of where the boundary is.

The boundary between state and corporate customers is a sales decision rather than a technical one. Until this offer the known users were an American immigration authority and ministries in Hungary and Austria, and no private company. If the next offer is accepted, little in the structure would show it: the purchase leaves no trace a regulator routinely sees, the data is bought rather than compelled, and the buyer’s use, as the marketplace maintains, is the buyer’s affair.

June 2026: Vienna renews the licence

On 30 June 2026 netzpolitik.org put the Austrian interior ministry on the customer list with a 1.85 million euro two-year extension of its Webloc licence, making Austria the second confirmed EU customer. The ministry declined to comment, citing security. A tracking researcher noted that even narrowly targeted use analyses the daily movements of millions of uninvolved people. The clerks observe that a purchase too sensitive to discuss stays legible in a procurement record, which is one of the few remaining places this market can be read from outside.

The purchase also works as a certificate. A market that sells to interior ministries has had its product treated as procurable by the institutions best placed to call it unlawful, and each renewed licence turns restriction into a decision about an existing government capability rather than about an abstract market. The pattern in the regulatory file is familiar: rules arrive without the resources to enforce them, and capabilities arrive on a purchase order.

June 2026: Police buying what a warrant would otherwise cost

On 2 June 2026 netzpolitik.org found German police forces in the market. Brandenburg and Mecklenburg-Vorpommern confirmed obtaining data from commercial providers, nine further states declined to answer, five denied it, and no state data protection authority could name a legal basis. A legal scholar’s assessment was that the practice would be unlawful as things stand. The clerks have underlined the observation that a judicial reservation is circumvented by purchase: the safeguard survives on paper and is bypassed at the invoice.

In Germany the safeguard attaches to compulsion. The state may oblige a carrier to hand over what it holds, subject to a court, and a purchase is not compulsion. Nobody is obliged, nothing is seized, and a rule drafted for the case where data has to be prised out of somebody does not obviously bind the case where it is on sale.

Two routes to the same thing, drawn side by side. On the compelled route, a police force that wants a person located makes an application to a court, which gives judicial authorisation and issues an order to the carrier that holds the data; a judge decides, and the order leaves a trace behind it. On the bought route, a police force opens an account with the bazaar, where edges 1 to 7 have already run, pays an invoice and receives a subscription with a login and a map; nobody is compelled, so nothing asks a judge anything. Both routes end at the same record of where a named person was and when. The safeguard is drafted for compulsion, and a purchase compels nobody, so the rule does not obviously bind it: one route is visible to a court and the other is visible on an expenses line.

At federal level the Bundestag’s research service found no authorising statute for the federal criminal police or the federal police, and the government has classified whether the purchases happen at all. A challenge needs somebody who can show they were affected, and secrecy about the practice removes the class of people who could ever demonstrate it. A contested legality that cannot be litigated is, for practical purposes, a settled one.

April 2026: Budapest, before an election

On 10 April 2026 netzpolitik.org reported that Hungary’s national security service had taken Webloc licences in March 2026, adding location tracking to a vendor relationship that already covered social media monitoring, fake account operations and phishing tooling across three Hungarian agencies. The clerks note the timing without drawing the conclusion, and observe that a capability bought for one purpose is available for the others.

2024: The supervisor joins the customers

As the German reporting ran through 2024, the federal interior ministry opposed barring intelligence services from buying broker data, calling it nonsensical to restrict that protection first, and Roderich Kiesewetter, deputy chair of the parliamentary oversight committee, found it sensible to make more use of such data for intelligence work, given the threat picture and the shortage of resources. The clerks note that a state buying here supervises a market it also funds through its venture programmes and now depends on operationally. Both positions are defensible on security grounds, and both turn a regulatory question into a procurement interest. The same member of that committee later advised citizens to switch their phones off for the whole commute. One suggestion buys from the market, the other asks people to hide from it, and neither touches it.

2023: The finished product changes hands

In 2023 Cobwebs Technologies, an Israeli firm, was merged into Penlink, an American company, after the American investment company Spire Capital bought it. Its tool, Webloc, reads advertising industry location data across up to 500 million devices: precise coordinates, the advertising identifiers that go with them, device metadata, and the demographics and interest categories the trade attaches to people. It shows which devices were in a given area at a given time, and follows them outward to the places they sleep. The catalogue extends past location into social media monitoring with facial recognition, a platform for running fake accounts, and one for phishing. A German sales office has been running since 2020, as Pen-Link GmbH since 2025. The clerks note that the raw material is the same commodity the marketplace sells; the vendor adds the interface, which turns a purchase of files into an operational capability a duty officer can use without knowing what a bid request is.

The customer list

The list divides by how each entry came to be known. Austria’s interior ministry appears in a licensing contract, and Hungary’s national security service in reporting on its procurement, alongside two other Hungarian agencies that have bought from the same vendor. Two German state criminal police offices confirmed their purchases when asked, nine further states declined to say, and the federal government has classified the question. An American immigration authority is reported as a user rather than confirmed as one. One luxury conglomerate was offered the tooling and turned it down. The tooling is the same in each case, the legal basis is contested or absent in most, and the purchases sit outside the procedures built for compelled data. The clerks note that the visible part of this market is whatever a procurement record happens to expose, and that the same capability is now being offered outside government as well as inside it.