There is no protected whistleblower status available for finding web bugs.

If you can pitch it as securities fraud, you might have a very small chance with the SEC. There is a new law protecting whistle blowers for the SEC, and it's seeing people apply to it for wide ranges of reasons. This seems related to the idea "everything bad a public company does is securities fraud".

It's fun to noodle about! But so far as I know, nothing like this has ever happened: nobody has gotten whistleblower protection from 18 USC 1030 charges, and there is no obvious legal pathway to get it from any agency of the federal government. Sell your bug to a carding ring, then go to the FBI and ask for immunity in exchange for helping them bring down the ring; that's the closest I can think of.

No, do not talk to the police. Anything they need to hear before charging you can be published publicly on the web. Anything they need to hear after charging you will be communicated to them in writing by your defense attorney.

I don’t see how it’d count as a whistleblower if it concerns a company that has no relation to your employer.