IP Geolocation: How Accurate Is It Really?

When a website detects your country, serves localized content, or blocks you based on region, it is almost certainly using IP geolocation — the practice of inferring a physical location from an IP address. Understanding how this works, and why it so frequently fails, is essential knowledge for developers, network engineers, and privacy-conscious users.

How IP Geolocation Works

IP geolocation does not rely on GPS or any direct location mechanism. Instead, it infers location from a combination of data sources:

1. IP Registration Data (WHOIS / RIR Records)

When an IP block is allocated to an organization, the Regional Internet Registry (ARIN, RIPE, APNIC, etc.) records the organization's registration address. This gives a rough country-level hint — the organization registering 192.0.2.0/24 might be registered in Germany.

Limitation: The registration address is the company's headquarters, not where the IPs are actually used. A German company's US data center might use IPs registered in Germany.

2. BGP Routing Data

IP address blocks are announced via BGP with associated Autonomous System (AS) numbers. AS registry data often includes country information. By correlating routing announcements with ASN registration data, geolocation databases get another country-level signal.

3. Active Latency Measurements

More sophisticated databases use active probing — sending ping packets to IP addresses from known locations and measuring round-trip times. A server that responds to pings from Frankfurt with 1ms latency but responds to pings from New York with 80ms latency is almost certainly in Frankfurt.

This technique is effective but expensive (requires infrastructure in many cities) and only works for IPs that respond to probes.

4. Crowd-Sourced and Passive Data

Some databases incorporate data from web analytics, GPS-tagged WiFi hotspot SSIDs, user reports, and ISP cooperation. When millions of users with known GPS locations (from mobile apps) are seen using specific IP ranges, that IP range can be confidently mapped.

5. ISP and Enterprise Cooperation

Many large ISPs and enterprises directly share their IP-to-location mapping with geolocation database providers. This is the most accurate data source but requires business relationships and is not universally available.

Major IP Geolocation Databases

MaxMind's GeoLite2 is the most widely deployed free database. The commercial GeoIP2 Precision product is significantly more accurate, especially for city-level data.

Accuracy: Country vs. City vs. Street

IP geolocation accuracy degrades dramatically as you increase precision:

Country-Level: ~95-99% Accurate

For most IP addresses, the country can be determined with high confidence. Country-level geolocation is reliable enough for: - Serving localized language/currency defaults - Licensing restriction enforcement - Regulatory compliance (GDPR data residency, etc.) - Basic fraud screening

Even at country level, edge cases exist: - Satellite internet (Starlink, HughesNet) — IP may be geolocated to the satellite provider's ground station country - Corporate VPNs — IP geolocates to corporate HQ country - Anycast addresses (Cloudflare, AWS CloudFront) — May appear as any country

Region/State-Level: ~70-85% Accurate

Region-level accuracy varies significantly by country. Urban areas in developed nations with well-documented ISP infrastructure are more accurate. Rural areas, developing nations, and small countries with limited ISP diversity are less reliable.

City-Level: ~50-75% Accurate

City-level geolocation is frequently wrong. Common causes: - Residential ISPs assign IPs from a regional pool, not city-specific blocks - The "city" may be the ISP's regional point of presence, not the user's city - Mobile carrier IPs are often geolocated to the carrier's headquarters city - Database staleness — ISPs reallocate IP blocks faster than databases update

Street/Building Level: Unreliable

True building-level precision from IP alone is effectively impossible without user consent and GPS data. Claims of "precise location" from IP addresses are marketing hyperbole.

Factors That Break IP Geolocation

VPNs and Proxies

A user connecting through a VPN server in Amsterdam appears to be in Amsterdam, regardless of their actual location. Most commercial VPN services use IP ranges that are well-known to geolocation databases — some databases specifically tag VPN/proxy IPs.

VPN detection services check: - Known VPN provider IP ranges (e.g., NordVPN, ExpressVPN ASNs) - Hosting/datacenter IPs (vs. residential ISP IPs) - Open proxy databases (like ProxyCheck.io, IPHub) - Behavioral signals (impossible travel — login from New York and Tokyo within minutes)

Tor

Tor exit nodes are publicly listed at https://check.torproject.org/cgi-bin/TorBulkExitList.py. Any IP in this list is trivially identified as Tor, but the actual user location is completely hidden.

CGNAT (Carrier-Grade NAT)

When hundreds of mobile users share a single IP (via CGNAT), the IP is geolocated to the carrier's NAT gateway location — which may be hundreds of kilometers from any individual user.

IPv6

IPv6 geolocation is generally less accurate than IPv4, partly because many databases have less historical data for IPv6 ranges and partly because large /48 or /64 allocations may cover entire regions.

Satellite Internet

Starlink users in rural Montana might appear to be in a different state or country because Starlink routes traffic through its ground station infrastructure. As the Starlink ground station network matures, this is improving.

Corporate and Cloud Networks

An employee working from home via corporate VPN appears to be at corporate HQ. Cloud workloads on AWS/GCP/Azure IPs appear to be wherever that datacenter is located, not where the end user is.

Real-World Accuracy Examples

MaxMind publishes accuracy statistics for their GeoIP2 database:

These figures represent "best case" for a premium database. Free databases are typically 10-20% less accurate at city level.

Improving Geolocation for Your Own IPs

If you run a network and want to ensure your IP block is correctly geolocated:

MaxMind Correction Form: Submit corrections at https://www.maxmind.com/en/geoip-location-correction

RIPE / ARIN Geofeed: RFC 8805 defines a standard geofeed format. Publish a geofeed file at a URL and register it in your WHOIS record:

# geofeed.txt format (RFC 8805)
# IP prefix, country, region, city, postal code
203.0.113.0/24,US,TX,Austin,78701
2001:db8::/32,US,TX,Austin,78701

Add to WHOIS/RDAP:

remarks: Geofeed https://example.com/geofeed.txt

Google, MaxMind, and other database providers have committed to consuming RFC 8805 geofeeds.

ARIN ISP Toolkit: ARIN provides mechanisms for ISPs to directly communicate IP-to-location mappings.

Legal and Privacy Implications

GDPR and Data Residency

Using IP geolocation to enforce data residency requirements (e.g., "only store EU users' data in the EU") is legally risky at high precision. Country-level determination is reasonable; finer granularity is not reliable enough for compliance decisions.

Website Blocking and Geo-Restrictions

Content licensing, gambling regulations, financial services, and export controls often require geographic restrictions. IP geolocation is the standard implementation mechanism, but its imperfection means: - Legitimate users get incorrectly blocked - VPN users bypass restrictions trivially

Most legal frameworks accept "reasonable effort" via IP geolocation for compliance purposes.

Privacy and Tracking

IP geolocation is a form of passive surveillance. Users who believe their IP address is private may not realize that their approximate location is trivially determinable by any website they visit. Privacy tools (VPNs, Tor, privacy-focused browsers) can mitigate this.

Practical Takeaways

• Country-level: Reliable enough for most practical uses; handle exceptions gracefully
• City-level: Treat as a hint, not a fact; expect 20-30% error rate
• Never make security-critical decisions solely based on IP geolocation
• Offer users a way to override location detection (language/currency selector)
• Mobile users are particularly poorly geolocated at city level
• Test with real users from your target regions — database accuracy varies significantly by geography