Developers say they didn't know gov't was buying user data
Comments on “Developers say they didn't know gov't was buying user data”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
404 Privacy's Seth Honda argues that app developers cannot claim ignorance after Bloomberg and Citizen Lab reported that Penlink's Webloc tool sells governments searchable phone-location histories, reportedly covering 12 months, drawn from the ad ecosystem. Developers of AccuWeather and Muslim Pro said they had no relationship with Penlink. Honda says embedding a location-collecting ad SDK feeds data into a market that includes government buyers, and urges developers to audit SDKs and test network traffic. The piece is opinion, and most figures lack cited sources.
Why it ranked
No. 5 of 107 with a score of 0.69. The panel rated it highest on new information (0.89) and reader interest (0.81), lowest on technical depth (0.51). Overclaim counted against it (0.52). Placed No. 5, No. 9 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Important privacy story on location data brokers and SDKs with real developer relevance, but largely opinion built on cited reporting and some rhetorical overclaiming; limited technical depth.
- AI judgeJudge 3gpt-5.6-luna
- Timely, consequential privacy and surveillance reporting with actionable SDK-audit guidance. It is well supported by cited investigations but primarily opinion, with some sweeping claims about developer responsibility, consent, and warrant requirements.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.69total under rubric v2.3
- Significance0.73
- Reader interest0.81
- Audience breadth0.74
- Practical relevance0.80
- Substantiated0.57
- Technical depth0.51
- New information0.89
- Counts against: Promotional0.04
- Counts against: Overclaim0.52
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.72 | 0.70 | 0.78 | 0.73 | 0.08 | +0.24 | +0.176 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.69 | 0.85 | 0.88 | 0.81 | 0.19 | +0.26 | +0.210 |
| Audience breadthHow many people who build technology does it concern? | 0.79 | 0.80 | 0.62 | 0.74 | 0.18 | +0.13 | +0.096 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.93 | 0.70 | 0.76 | 0.80 | 0.23 | +0.22 | +0.175 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.43 | 0.55 | 0.72 | 0.57 | 0.29 | +0.05 | +0.028 |
| Technical depthHow technically substantive is it? | 0.70 | 0.40 | 0.44 | 0.51 | 0.30 | +0.05 | +0.026 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.91 | 0.80 | 0.97 | 0.89 | 0.17 | +0.05 | +0.045 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.08 | 0.03 | 0.01 | 0.04 | 0.07 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.40 | 0.45 | 0.72 | 0.52 | 0.32 | −0.11 | −0.058 |
| Sum of contributions | +0.690 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.691 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-07/5/"><img src="https://rubric.hrih.si/badge/2026-11-07/5.svg" alt="Ranked #5 on Rubric, 7 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Penlink's Webloc software lets clients see all phones in a particular area at a specific time, with historical data going back 12 months, and follow those phones home.
The article gives no link or citation for it.
The article says “Webloc allows clients to see all of the phones that were in a particular area at a specific time, with historical data going back 12 months, then follow those phones…”
The source says No source to compare with.
No source givenNumber
Start.io has placed its SDKs in more than 500,000 apps that have collectively been downloaded more than 25 billion times.
The article gives no link or citation for it.
The article says “Start.io has placed its SDKs in more than 500,000 apps that have collectively been downloaded more than 25 billion times”
The source says No source to compare with.
No source givenNumber
Start.io's marketing says its SDK can reach 2.4 billion devices globally, including 300 million in the US.
The article gives no link or citation for it.
The article says “their SDK can reach 2.4 billion devices globally, including 300 million in the US alone”
The source says No source to compare with.
No source givenNumber
The ACLU reported that ICE signed a 2.3 million dollar contract in the fall of 2025 with Penlink for access to surveillance tools including Webloc.
The article gives no link or citation for it.
The article says “The ACLU reported that ICE signed a 2.3 million dollar contract in the fall of 2025 with Penlink for access to surveillance tools including Webloc”
The source says No source to compare with.
No source givenGeneralization
Penlink's customers, as reported by Citizen Lab and Bloomberg, include ICE, US military branches, and more than a dozen American police departments, and authorities in several other countries.
The article gives no link or citation for it.
The article says “includes US Immigration and Customs Enforcement, which has spent millions on related contracts, branches of the US military, and more than a dozen American police departments”
The source says No source to compare with.
No source givenNumber
Electronic Frontier Foundation records showed the Tucson police department used Webloc to identify suspects in thefts and burglaries and in the abduction of a University of Arizona student.
The article gives no link or citation for it.
The article says “internal records obtained by the Electronic Frontier Foundation showed the department used Webloc to identify suspects in thefts and burglaries and in the abduction of a University of Arizona student”
The source says No source to compare with.
No source givenNumber
AccuWeather and Muslim Pro have more than 100 million downloads between the two apps, and their developers told Bloomberg they had no relationship with Penlink.
The article gives no link or citation for it.
The article says “Despite having more than 100 million downloads between the two apps, AccuWeather and Muslim Pro's developers told Bloomberg they had no relationship with Penlink”
The source says No source to compare with.
No source givenDate
In 2018 the Supreme Court in Carpenter v. United States required a warrant for location data obtained from telecom carriers, and the Justice Department has argued purchased commercial data falls outside that requirement.
The article gives no link or citation for it.
The article says “In 2018, the Supreme Court decided Carpenter v. United States, and required a warrant for location data obtained from telecom carriers”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 7 Nov 2026, 05:47 UTC. It played no part in the ranking.