IP Geolocation: How It Works, What It Returns and Its Limits

Every connection to the internet comes from a public IP address, and every public address belongs to a block that some network operates. IP geolocation turns that into an estimate: a country, region and city, coordinates with a margin of error, a time zone and the network’s name. This guide covers where the data comes from, what a lookup returns, how far to trust it, what it’s used for and where it falls short.

The box shows how your own connection is geolocated right now.

What is IP geolocation?

IP geolocation maps an IP address to a location and to the network that uses it. It describes where an address block is in use and who operates it, not where a particular device is. Nothing is measured on your phone or computer, and no permission is needed, because every server you contact sees your public IP address anyway.

GeoIP is another name for IP geolocation, often used for the databases behind it; see GeoIP lookups and databases.

How does IP geolocation work?

No single source says where an IP address is. Geolocation databases combine several, check them against each other and repeat the process, because addresses keep moving between networks and places.

1. Registries record who holds each address block

The Internet Assigned Numbers Authority (IANA) allocates large pools of IP addresses and autonomous system numbers to five regional internet registries (RIRs). The RIRs assign smaller blocks to providers, hosting companies, universities and other organizations (in some countries through a national registry), which assign addresses to customers and devices.

Registries publish their records through WHOIS and its JSON-based successor, RDAP. A record names the block’s holder, a country, contacts and usually an abuse address. That’s a good start for the country and the network name, but it describes the holder, not the users: a block registered at a company’s headquarters can serve other cities or countries. RFC 9632 notes that location hints in registry records “tend to be administrative, and not deployment specific.” IPv4 blocks are also transferred and leased, so records can lag behind actual use.

2. Network operators publish geofeeds

The most direct source is the operator’s own statement. A geofeed, defined in RFC 8805, is a CSV file in which a network lists its prefixes and where each one is used:

As one line of the file, that entry reads 192.0.2.0/24,US,US-CO,Denver,. Only the prefix is required, so an operator can publish as little as the country. RFC 8805 deprecates the postal code because postal codes can be precise enough to point to a single building.

RFC 9632 (2024) explains how to find the feed for an address. The operator links it over HTTPS from the block’s registry record with a geofeed: attribute, or with a remarks: Geofeed line where the registry doesn’t support the attribute yet. Consumers use the most specific record with such a link and ignore the registry’s other location hints for that range. An optional RPKI signature lets them verify that the feed comes from the holder of the addresses, and RFC 9877 (October 2025) adds the geofeed link to RDAP responses.

The standards set a weekly rhythm: consumers should re-read a feed at least weekly (RFC 8805) but, unless the server says otherwise, not more often (RFC 9632). Databases then ship updates on their own schedules, so a correction can take days or weeks to appear everywhere. Publishing a feed is voluntary, and a 2025 academic study of registry data found geofeed links in only a small fraction of records.

3. Routing data shows which network announces an address

Networks on the internet, called autonomous systems, announce the prefixes they carry to each other with the Border Gateway Protocol (BGP). Each has an autonomous system number (ASN) from a registry. Public routing data shows which network originates a prefix right now, so a lookup can name the ISP and its ASN even when a registry record is stale. RFC 8805 mentions checking a geofeed’s prefixes against the publisher’s BGP announcements to confirm that it really operates them. Routing rarely pins down a place, though, because one network can span a continent.

4. Latency and traceroute set physical limits

Light in optical fiber travels roughly 200 km (124 miles) per millisecond. If a server at a known location gets a reply from an address within 1 ms round trip, the address is at most about 100 km (62 miles) away. Real cables take detours and routers add delay, so that’s an upper bound. With measurements from several known locations, the possible area shrinks to where the circles overlap.

Traceroute adds the path: it lists the routers in between, and router host names often contain city names or airport codes. RIPE IPmap, a public RIPE NCC service, combines both ideas to geolocate routers and other infrastructure, using latency measurements from RIPE Atlas probes at known locations and hints in reverse DNS names. The blind spot: many home routers and phones don’t answer probes, so measurements usually locate the provider’s last router, not the customer.

5. Corrections and other signals fill gaps

Network operators and users report wrong locations, and providers check the reports against their other sources. Some data providers also match IP addresses with location reports from apps or devices whose users agreed to share their position. Host names and published address lists help classify addresses as data center, mobile, relay or residential. Apple, for example, publishes the exit addresses of iCloud Private Relay with their locations.

6. Databases merge, score and refresh

A database merges these inputs for each prefix, resolves conflicts and decides how precise its answer can be: city, region or only country. Some add an accuracy radius or a confidence score. Then the cycle starts again, because providers reassign blocks and addresses change hands.

IPv6 geolocation: same methods, bigger blocks

An IPv6 address has 128 bits. The first half, the prefix, identifies the network, and the second half identifies the device’s interface. Providers give each customer a whole prefix: the RIPE best-practice document RIPE-690 recommends a /48 for businesses and at least a /56 for homes, and mobile networks often give each phone a single /64. Geolocation therefore works on prefixes, not single addresses, and geofeeds list IPv6 prefixes just like IPv4 ones.

Two details matter. Temporary “privacy” addresses (RFC 8981) change the interface half regularly but keep the prefix, so the location stays the same. And on a dual-stack connection, the IPv4 and IPv6 addresses can leave the provider’s network at different points and geolocate to different cities.

What an IP geolocation lookup returns

A lookup takes an IP address and returns a record. Field names differ between databases, but the content is similar:

Here’s a concrete example from iplookupapi, with the response trimmed to the connection, location and time zone fields:

curl -H "apikey: $IPLOOKUPAPI_KEY" "https://api.iplookupapi.com/v1/info?ip=80.110.0.1"

{
  "data": {
    "ip": "80.110.0.1",
    "type": "v4",
    "connection": {
      "asn": 8412,
      "organization": "Magenta Telekom GmbH",
      "isp": "Magenta Telekom",
      "range": "80.110.0.0/24"
    },
    "location": {
      "continent": { "code": "EU", "name": "Europe" },
      "country": { "alpha2": "AT", "alpha3": "AUT", "name": "Austria", "is_in_european_union": true },
      "region": { "alpha2": "AT-9", "name": "Vienna" },
      "city": { "name": "Vienna" },
      "zip": "1010",
      "latitude": 48.198674,
      "longitude": 16.348388,
      "precision": "city",
      "accuracy_radius_km": 3.1
    },
    "timezone": {
      "id": "Europe/Vienna",
      "code": "CEST",
      "is_daylight_saving": true,
      "gmt_offset": 7200
    }
  }
}

The precision field says which level the coordinates stand for, here a city. The accuracy_radius_km field is the radius around the coordinates that holds 80% of the addresses, and gmt_offset is in seconds.

How accurate is IP geolocation?

Accuracy drops as you zoom in. The country is usually right, because an address block is normally used within one country, and the region often is. The city is often off, and the coordinates mark the center of an area, never a building. The connection matters as much as the database:

• Home broadband: the best case. A wrong city is often a nearby one where the provider’s network hub sits.
• Mobile data: carriers route traffic through a few regional gateways, and carrier-grade NAT (CGNAT) puts many customers behind one public address. Phones often appear in the gateway’s city, sometimes in another state.
• Satellite internet: traffic enters the internet at ground stations or points of presence, sometimes hundreds of miles from the user.
• Work and school networks: traffic often exits at headquarters, or through a VPN concentrator or a cloud security service.
• Cloud and hosting addresses: the lookup finds the data center, not the person using a service there.
• Anycast addresses: one address is announced from many places at once, as with public DNS resolvers and CDNs, so no single answer is right.
• VPNs, proxies, Tor and privacy relays: the lookup sees the exit server, not the user.

Databases also disagree, because they weigh sources differently and update at different times. How accurate IP geolocation is goes deeper, level by level, and covers fixing a wrong location.

What IP geolocation is used for

• Localization. Preselect language, currency and units from the visitor’s country, and let visitors change them. IP to country lookups cover country-level defaults.
• Content licensing and geo-blocking. Media rights are often sold per territory, so streaming services check the country before they play content. Online shops have less room: the EU’s Geo-blocking Regulation (2018/302) bars sellers from blocking customers from other EU countries, or redirecting them without consent, because of their nationality or place of residence. Audiovisual services fall outside it.
• Fraud and risk checks. Compare the IP country with the billing address, phone prefix or usual login location. A mismatch calls for a closer look, not a verdict.
• Tax and compliance. EU VAT rules for digital services list the customer’s IP address, or any other geolocation method, among the evidence for where the customer is. IP location is also one signal for sanctions screening and for age or gambling rules that differ by country or state, often combined with account data or device location.
• Analytics. Count visitors, sign-ups or errors by country or region without asking anyone and without keeping full IP addresses.
• Advertising. Ad platforms use IP location to target and report campaigns by country and region.
• Cybersecurity. Enrich firewall and server logs with country and ASN, flag logins from two distant countries within minutes and restrict admin access by region.
• Time zones and scheduling. Show local times, send notifications during the recipient’s day and preset the time zone in sign-up forms. See IP time zone lookups.

Limits of IP geolocation and privacy

What IP geolocation can’t do

IP geolocation isn’t GPS. It never sees the device, only the address it uses, and it can’t name a person. Only the internet provider can match an IP address and a time to a customer account, and US providers generally release that only under legal process, such as a subpoena or court order. What an IP address tells you separates what an address reveals from what it doesn’t.

Some services replace the address a site sees:

• VPNs and proxies: sites see the server’s address and locate the server.
• Tor: traffic leaves through a volunteer-run exit relay that can be in any country.
• iCloud Private Relay: Safari traffic comes from a relay address. Apple says it keeps the user’s region and, by default, an approximate city; users can widen it to their country and time zone.

IP addresses and privacy law

The EU’s GDPR names internet protocol addresses as an example of online identifiers that can identify people (Recital 30). In Breyer (C-582/14, 2016), decided under the GDPR’s predecessor, the EU Court of Justice ruled that even a dynamic IP address a website stores is personal data for the website operator if it has legal means to identify the user with additional data held by the user’s internet provider. If you serve EU visitors, treat IP addresses and the locations you derive from them as personal data: have a legal basis, keep only the level you need, such as the country, and shorten or delete full addresses once you no longer need them. California’s CCPA lists IP addresses among the identifiers that count as personal information. This is general information, not legal advice.

IP geolocation vs. GPS, Wi-Fi and browser location

When a site or app knows your street, the location didn’t come from your IP address.

The browser API is an interface, not a separate technology: the W3C specification lists GPS, IP address, Wi-Fi, Bluetooth and cell IDs as possible sources and requires express permission before a site gets a position. A VPN changes only the IP location.

How to look up the location of an IP address

Your own IP address

The box near the top of this page shows your public IP address and where it places you. Where am I goes through each line, explains why it can differ from your real location and has a lookup form for any other IPv4 or IPv6 address, such as one from your server logs.

Any IP address

Paste the address into an IP geolocation tool such as that lookup form. To see who holds the block, query the registry record. On macOS, or on Linux with the whois package installed, run:

whois 80.110.0.1

The record shows the holder, a country and an abuse contact. It describes the network rather than a device, and for home connections it names the provider, not the subscriber. No public tool turns an IP address into a home address; an “IP location tracker” only shows the network’s approximate area.

Many IP addresses (bulk IP geolocation)

For log files, sign-up lists or analytics jobs, a bulk lookup is faster than one call per address. The batch IP lookup API takes up to 1,000 IPv4 and IPv6 addresses in one request and returns the same fields for each address.