72 Lawmakers Demand DHS IG Investigate Warrantless Location-Data Purchases by ICE

In March 2026, 72 Democratic members of Congress, led by Senator Ron Wyden and Representative Adriano Espaillat, wrote to the DHS Inspector General demanding an investigation into warrantless purchases of Americans’ location data by ICE and other federal agencies. NPR reported the demand on March 25.

The tool at issue is Webloc, sold by Penlink following its 2023 merger with Cobwebs Technologies. The Citizen Lab’s analysis — published April 9, 2026, after the letter — describes a constantly updated stream of records from up to 500 million mobile devices globally, carrying device identifiers, location coordinates and profile data harvested from mobile apps and the digital advertising pipeline. It permits monitoring an entire neighborhood for devices, tracing an individual phone’s movements over time, and inferring home and work addresses.

Citizen Lab identifies the U.S. customer set as including ICE, the U.S. military, the Texas Department of Public Safety, DHS West Virginia, New York City district attorneys, and police departments in Los Angeles, Dallas, Baltimore, Tucson and Durham among smaller jurisdictions.

The oversight history is the structural point. ICE ended a prior location-data program in 2023 after congressional scrutiny, and DHS announced in 2024 that it was ending data-broker contracts for bulk cell-phone location data. Both of those are announcements of cessation. The purchases at issue here post-date both. What the record shows is not a program that continued despite oversight, but one that was announced as ended and then reappeared under a different vendor relationship — which is why the remedy sought in March is an Inspector General investigation rather than a policy change.

This sits at the head of a documented chain. FBI Director Patel confirmed warrantless purchase of commercially available data on March 18. DHS signed the Penlink PLX no-bid contract for warrantless real-time interception on April 29. The Maryland Attorney General filed a complaint naming Penlink and Thomson Reuters in August. And in June the Supreme Court held in Chatrie that government access to stored location data is a Fourth Amendment search — a ruling whose implications for purchased, rather than compelled, data remain unsettled.

Sourcing note. The lawmaker count is 72, not the 70 recorded in the capture ledger, and the letter was led by Wyden and Espaillat. The Citizen Lab report is dated April 9, 2026 — after this entry’s date — so its findings are cited here as the fullest public description of a tool the March letter was already asking about, not as its basis. The contract figures in the ledger ($2.3M DHS, $2.9M PLX variant) are not carried into this entry: they describe the separate PLX procurement recorded at 2026-04-29 and were not verified here.