Every Ad You See Is a Spy: How the System Works

TL;DR: Every time an ad loads on your phone, a system called Real-Time Bidding broadcasts your GPS coordinates, device ID, demographics, and browsing habits to thousands of companies, all within a millisecond. This happens 178 trillion times a year across the US and Europe. Government agencies including ICE, the FBI, the military, and police departments in at least seven cities buy this data from brokers who harvest it from those ad auctions. No warrant. No court order. Just a purchase order. Citizen Lab’s April 2026 investigation into Webloc confirmed the system tracks 500 million devices worldwide with three years of history. Your ad blocker isn’t a convenience anymore. It’s a survival tool.

Step by Step: How Your Phone Becomes a Tracking Beacon

Open your weather app. Check the forecast. Close it.

In the fraction of a second that app loaded, here’s what happened behind the screen:

Step 1: The app requests an ad. To do this, it sends a data packet to an ad exchange, a company that runs auctions for ad space. That packet is called a “bid request.”

Step 2: The bid request contains your Mobile Advertising ID (MAID), your GPS coordinates, your IP address, your device type, what app you’re using, your browsing history, and demographic data like estimated age and gender ^[1].

Step 3: The ad exchange broadcasts this bid request to hundreds (sometimes thousands) of companies simultaneously. Each one receives your data, whether or not they win the auction ^[2].

Step 4: Advertisers bid on your ad slot. The highest bidder wins. Their ad appears on your screen. Takes about 100 milliseconds.

Step 5: You see a banner ad for shoes. Meanwhile, several thousand companies just logged your exact location, your device fingerprint, and your behavioral profile.

This is Real-Time Bidding. It happens 178 trillion times a year ^[2]. And the advertising industry designed it this way on purpose, because bid requests containing more personal data attract higher bids. The system has a financial incentive to harvest as much data about you as possible.

The Companies That Don’t Even Pretend to Buy Ads

Here’s the part the ad industry doesn’t talk about.

Many of the companies participating in RTB auctions aren’t actually buying ad space. They’re data brokers posing as advertisers. They register as bidders, receive the bid requests packed with your personal data, and never place a single ad. They just harvest.

The FTC caught one of them. Mobilewalla collected data on over one billion people, with roughly 60% sourced directly from RTB auctions ^[3]. The company then sold custom audience segments to its clients: “union organizers,” “Black Lives Matter protesters,” “pregnant women,” “LGBTQ+ community members” ^[3].

Israeli surveillance vendor Rayzone and a company called Patternz took it further, posing as ad buyers specifically to build phone-tracking tools that they sold to governments worldwide ^[2].

One data broker with RTB access told researchers at Citizen Lab it had “data on more than one billion mobile devices.” Another, collecting through software development kits (SDKs) embedded in 400 apps, claimed coverage of 40 million phones ^[4].

From Ad Auction to Government Database

The pipeline from your weather app to a government analyst’s screen has three stops.

Stop 1: The auction. Your app fires a bid request. Thousands of companies receive it.

Stop 2: The broker. Companies like Venntel, Gravy Analytics, and Near Intelligence collect, aggregate, and repackage RTB data into searchable databases. Venntel supplied location data to the FBI, ICE, CBP, and other agencies through its parent company Gravy Analytics ^[3]. Near Intelligence sold data covering “more than a billion devices” to the U.S. Defense Department ^[2].

Stop 3: The surveillance tool. Companies like Penlink buy broker data and build polished interfaces on top of it. Their product, Webloc, lets government customers draw a box on a map, pick a time window, and watch every device that passed through. Three years of history. 500 million devices worldwide. Billions of daily location signals ^[4].

In March 2026, a document obtained by 404 Media confirmed that even Customs and Border Protection acknowledged its surveillance program drew from RTB-sourced location data ^[5]. The government isn’t hiding it anymore.

Confirmed Webloc customers include: ICE ($2.3 million contract), U.S. military units, Texas Department of Public Safety, police departments in Los Angeles, Dallas, Baltimore, Durham, Tucson, Pinal County, and Elk Grove, Hungary’s intelligence service, and El Salvador’s national police ^[4].

The “Anonymous” Data Lie

The advertising industry’s defense: “It’s anonymized. We use advertising IDs, not names.”

The FTC’s response, verbatim: Mobile Advertising IDs “offer no anonymity in the marketplace” because “many” companies “regularly link consumers’ MAIDs to other information about them, such as names, addresses, and phone numbers” ^[4].

Here’s why. Your MAID sits in the same location every night: your home. It travels to the same building every weekday: your office. Cross-reference that pattern with any database that connects addresses to names (voter rolls, property records, data brokers that sell identity resolution), and your “anonymous” advertising ID becomes your full name, home address, and daily routine.

When Apple gave iPhone users the option to opt out of ad tracking in 2021, 96% of U.S. users said no ^[5]. That number tells you everything about how much people actually want this system.

Why Warrants Don’t Apply

The Supreme Court ruled in Carpenter v. United States (2018) that the government needs a warrant to get your cell-site location data from phone carriers.

But Carpenter addressed data obtained through legal process from telecommunications companies. It didn’t cover data the government buys on the open market from advertising brokers.

That’s the data broker loophole. The Fourth Amendment says the government needs a warrant to track you. The government says: “We didn’t track you. We bought tracking data from a company that tracked you. Totally different.”

The Fourth Amendment Is Not For Sale Act and the Government Surveillance Reform Act would close this loophole. Congress hasn’t passed either one. Meanwhile, FISA Section 702 (the government’s other warrantless surveillance authority) faces its own April 30 deadline.

Citizen Lab director Ron Deibert put it directly: “If this type of highly invasive technology is used without proper oversight, without proper judicial authorization, they’re essentially violating the constitutional protections” ^[6].

How to Stop Being a Dot on Their Map

You can’t fix the system. But you can make yourself invisible to it.

1. Kill your advertising ID.

iPhone: Settings → Privacy & Security → Tracking → Turn off “Allow Apps to Request to Track”
Android: Settings → Privacy → Ads → Delete advertising ID

This removes the persistent identifier that ties all your ad data together. Without it, brokers can’t easily link your morning coffee shop to your evening commute to your home address.

2. Use an ad blocker. Everywhere.

If the ad request never fires, your data never enters the RTB pipeline. On iOS, use a content blocker in Safari. On Android, use Firefox with uBlock Origin. On your home network, set up a DNS-level blocker like Pi-hole or NextDNS.

This isn’t about avoiding annoying pop-ups. Every blocked ad is a location broadcast that never happened.

3. Revoke location permissions aggressively.

Go through every app on your phone right now. Any app that doesn’t genuinely need your GPS coordinates to function (weather apps, games, flashlight apps, social media) revoke its location access. If an app demands location to work and has no reason to, delete it.

4. Use a privacy-respecting DNS.

Switch your phone’s DNS to a provider that blocks tracking domains: Mullvad DNS, NextDNS, or AdGuard DNS. This intercepts ad requests at the network level before they leave your device.

5. Consider a privacy-focused phone OS.

GrapheneOS and CalyxOS strip out the advertising infrastructure that feeds RTB. No Google Play Services means no MAID, no ad auction participation, and no data broadcast. This is the most aggressive option and requires a Pixel phone.

6. Tell Congress to close the loophole.

The Fourth Amendment Is Not For Sale Act would require a warrant for government purchases of advertising data. Contact your representatives. The data broker loophole is the reason this entire pipeline works.

The System Isn’t Broken. It Was Built This Way.

Real-time bidding wasn’t hijacked for surveillance. The architecture was always designed to broadcast personal data to thousands of companies simultaneously, because that’s what makes the ads profitable.

Surveillance vendors just realized they could register as bidders and collect the data for free. Governments realized they could buy it instead of getting a warrant. And the advertising industry shrugged, because the data was already flying around.

Google recently settled a case that may bring new privacy controls to RTB ^[7]. The FTC has started enforcement actions against the worst data brokers ^[3]. But the fundamental architecture (broadcast everything to everyone, ask questions never) remains intact.

Every ad you see is a spy. Your ad blocker is your bodyguard. Use it.

References

Published: April 28, 2026