The massive, multi-billion-dollar online advertising ecosystem, frequently described as “surveillance capitalism”, is increasingly being weaponized by state and non-state actors around the world to track journalists, compromise their sources, and expose confidential reporting, according to a new report published by the New York-based Committee to Protect Journalists (CPJ).
The special report titled “How mass surveillance from online advertising puts journalists at risk,” described the emerging system as a “surveillance ecosystem” consisting of software development kits (SDKs) embedded in applications, real-time bidding (RTB) advertising exchanges, major technology companies, data brokers, advertising intelligence (ADINT) companies and firms developing spyware capable of being delivered through online advertisements.
According to the report, “Personal data of internet users, including their locations and other intimate details, is being constantly collected and used to inform online advertising strategies in what has grown into a nearly $1 trillion marketplace. Commonly referred to as surveillance capitalism, this global ecosystem of data extraction, commodification, and use is central to the business model of the world’s biggest tech companies, and is increasingly part of law enforcement tactics and government intelligence operations.”
CPJ said in the report published on August 27, 2026, that the surveillance threat had expanded beyond traditional government monitoring and commercial data collection to encompass an interconnected ecosystem involving mobile applications, advertising technology companies, data brokers, advertising intelligence firms, and spyware vendors.
Written by Jonathan Rozen, CPJ’s Deputy Director of Research and Analysis and published in collaboration with Harvard University’s Carr-Ryan Center for Human Rights, the report noted that personal information generated through ordinary internet and smartphone can include a person’s location, device identifiers, browsing behaviour, interests, employment, political affiliations, and other sensitive information.
Once collected, the data can be sold or repurposed for purposes far beyond advertising, including targeted surveillance.
The report cited the experience of Belgian journalist Nicolas Baudoux, who was able to identify people from a data set containing approximately 100 million locations associated with about one million mobile devices over a two-week period in 2025.
German journalist Ingo Dachwitz, who has investigated privacy and data-brokerage issues, also discovered his own information in a publicly available sample of commercial location data. Dachwitz had previously permitted a weather application to track his location.
CPJ said such cases illustrated how information generated through everyday applications could potentially be transformed into a detailed record of an individual’s movements and activities.
A major concern identified in the report is the use of SDKs and RTB systems to collect and distribute information about users. SDKs are software components incorporated into mobile applications and can facilitate the collection of information such as a user’s location. The information can subsequently enter the advertising ecosystem.
RTB, on the other hand, allows advertisers to bid almost instantaneously for advertising space when a person opens a website or application. In the process, information associated with the user’s device can be transmitted to multiple parties participating in the advertising marketplace.
CPJ quoted privacy experts as warning that such information can include highly sensitive details, and the sheer number of entities receiving the data makes it difficult for users to know who ultimately possesses their information or how it may subsequently be used.
The report noted that mobile advertising IDs, although generally not displaying a person’s name, can be used to associate information with a particular device and ultimately with an identifiable individual.
Researchers at the University of Washington had previously demonstrated that knowledge of a device’s advertising ID could be used to serve advertisements to the device at specific locations, thereby confirming whether the target was present there.
CPJ said the technique could have serious implications for journalists who meet confidential sources in person or travel to sensitive locations.
The report also examined the growing role of data brokers and advertising intelligence companies, which purchase, aggregate, and sell information collected through apps and online advertising systems.
CPJ said advertising intelligence companies had emerged to provide specialized surveillance services based on commercially collected advertising data, adding that such services can reportedly enable customers to identify devices, trace historical movements and, in some cases, monitor locations in near real time.
The report cited research by Citizen Lab into Penlink’s Webloc product, described as a geolocation surveillance system using data purchased from consumer applications and digital advertising.
According to CPJ, investigations have indicated that customers of such technologies have included intelligence, police, military, and law enforcement agencies in several countries.
It warned that the implications for journalism could be particularly serious because commercially acquired location data could potentially reveal who journalists meet and where they go, and cited the experience of journalists and researchers who expressed concern that information about their movements could expose confidential meetings with sources.
The report also highlighted an emerging and potentially more dangerous development in the use of online advertisements as a mechanism for delivering spyware, explaining that investigations by Haaretz, Amnesty International, and Google’s Threat Intelligence Group have revealed evidence of spyware vendors exploring advertising-based delivery methods.
It said the risks were being amplified by advances in artificial intelligence, which can make it easier to analyse enormous quantities of commercially collected information and identify patterns that would previously have been difficult or impossible to detect.
The report cited warnings from United Nations human rights experts that AI systems could intensify surveillance by enabling the collection and analysis of unprecedented volumes of data, saying the increasing ability to combine different sources of information meant that data that appeared relatively harmless in isolation could become highly revealing when aggregated and analysed.
CPJ warned that journalists and media organisations face a difficult contradiction as the same digital infrastructure that helps them reach audiences and generate revenue may expose journalists and their readers to extensive data collection.
It noted that a June 2026 study of laws in Europe and the United States found significant gaps and ambiguities in legal frameworks governing the entire lifecycle of commercially sourced data, including concerns about its implications for press freedom.
The report also cited warnings from the UN Special Rapporteur on Freedom of Assembly and Association, Gina Romero, that private technology companies had created data-harvesting infrastructures that states could subsequently exploit for surveillance.
For journalists, CPJ said, the consequences could include intimidation, exposure of sources, monitoring of movements, psychological harm, and the chilling of legitimate investigative reporting.
It urged journalists to take steps to reduce their exposure to advertising-based surveillance, including limiting application permissions, being cautious about applications installed on devices, and reducing unnecessary location tracking.
The report concluded that the scale and opacity of the commercial surveillance industry make it difficult to determine how many companies are involved or how frequently journalists are being targeted, noting that the growing availability of personal data, increasingly powerful analytical tools, and the potential involvement of state actors create a significant and evolving threat to journalists’ privacy, source protection, and freedom to report.
