How Does IP Geolocation Work?

IP geolocation works by looking an IP address up in a database that maps ranges of addresses to physical locations. Those databases are built from registry allocations, data that ISPs publish about their own networks, internet routing information, and active latency measurement — not from GPS or anything on the user's device.

That distinction is the whole story. Because the answer is assembled from records about networks rather than observations of devices, IP geolocation is very good at telling you which country an address belongs to and progressively less good the more precision you ask of it. Understanding where the data comes from tells you exactly how far to trust it.

How Does IP Geolocation Work?

Five independent inputs feed a modern geolocation database. No single one is sufficient; providers combine them and reconcile the disagreements.

1. Regional Internet Registries allocate the blocks

The foundation is administrative. IANA delegates large ranges of addresses to five Regional Internet Registries — ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, and AFRINIC for Africa. Each RIR then allocates sub-blocks to ISPs and organizations in its region, and publishes who received what. This gets you reliable country-level attribution almost for free: if RIPE assigned a block to a German ISP, the addresses in it are very probably being used in Germany.

2. ISPs publish sub-allocations and geofeeds

Registry data stops at the ISP. What happens inside that allocation — which /24 serves Hamburg and which serves Munich — is only known to the operator. Many ISPs publish this voluntarily as a geofeed, a simple CSV of prefix-to-location mappings described by RFC 8805. Geofeeds are the single most accurate source available when they exist, because they are self-reported by the party that actually knows. Coverage is uneven, which is a large part of why city-level accuracy varies so much by region.

3. BGP routing and ASN data narrow it down

Every network announces its prefixes to its neighbours via the Border Gateway Protocol, and those announcements are publicly observable. They reveal which autonomous system currently originates a prefix, which upstream providers it connects through, and where those interconnections physically happen. If a prefix is only ever announced through exchanges in São Paulo, that constrains its location regardless of what any registry record says. This is also the layer that reveals whether an address belongs to a residential ISP or a hosting provider — you can query it directly with an ASN lookup.

4. Active measurement: latency and traceroute

Where records are missing or stale, geolocation providers measure. Light in fibre travels roughly 200 km per millisecond, so round-trip times from a set of probes with known positions put a hard ceiling on how far away an address can be. Take measurements from enough vantage points and the intersection of those constraints triangulates a metropolitan area. Traceroute adds detail: intermediate router hostnames frequently encode airport or city codes, which gives a strong hint about the path's geography.

5. Crowd-sourced correlation datasets

Finally, some datasets correlate IP addresses with locations reported by devices that knew where they were through other means — a phone with GPS on a known Wi-Fi network, for example. These can be very precise but decay quickly, because addresses get reassigned. They are best treated as one weighted signal among several rather than ground truth.

IP Geolocation vs. GPS: Why It's an Estimate

GPS is a measurement your device makes of its own position, accurate to a few metres and requiring the user's permission. IP geolocation is an inference a server draws about a network address, accurate to a city on a good day and requiring nothing from the user at all. They answer different questions and fail in different ways.

That "requires nothing" property is exactly why IP geolocation is useful. It works on the very first request, before any consent dialog, before any account exists — which makes it the right tool for setting a currency, choosing a CDN edge, or deciding whether a login looks plausible. It is the wrong tool for anything that needs to be precise or that the user would expect to have agreed to.

How Accurate Is IP Geolocation?

Accuracy is not a single number; it depends entirely on how fine a geography you ask for. These are the figures we publish for our own data, and they are broadly representative of the industry:

IP Geolocation Accuracy at City Level

City accuracy is where the variance lives, and the causes are structural rather than random:

• Carrier-grade NAT and mobile networks. Mobile carriers route enormous numbers of subscribers through a small number of egress points. Everyone on that gateway geolocates to the gateway, which may be hundreds of kilometres from the actual handset.
• Regional POP centroids. When a provider knows the region but not the city, the honest fallback is the centre of the region — which is why a suspicious number of addresses resolve to a country's geographic midpoint.
• Corporate WAN egress. A company that backhauls branch-office traffic through headquarters gives every employee the head office's location, whatever building they are in.
• Satellite and VSAT links. Addresses are often allocated at the teleport rather than the subscriber, so the location can be off by a whole country.
• VPN and proxy egress. Here the database is not wrong at all — the address genuinely is where it says. It just is not where the human is.

What IP Geolocation Can and Can't Tell You

It reliably tells you the country, usually the region, often the city, the timezone, and the ISP and autonomous system that operate the address — plus, in a well-built API, whether the address is a VPN, proxy, Tor node, or datacenter host.

It cannot tell you a street address, a named individual, which building or floor a request came from, or anything about the device beyond what the network reveals. Any service advertising street-level precision from an IP address alone is overstating what the underlying data can support — the inputs described above simply do not contain that information.

Why the Result Is Sometimes Wrong

Most reports of "wrong" IP geolocation turn out to be correct answers about something other than the user. Working through the likely causes in order:

1. The user is on a VPN or proxy. Check the anonymizer flags before concluding anything else.
2. The address is a datacenter host. A cloud IP resolves to the cloud region, which is a fact about the server, not the visitor.
3. Mobile or CGNAT egress. Expect the carrier's gateway city, not the handset's.
4. Corporate backhaul. The head office wins.
5. The block was recently reassigned. Registry transfers happen faster than some databases refresh.
6. No geofeed for that ISP. The provider falls back to a regional centroid.

The first three are detectable in the same response you already have. If is_vpn, is_proxy, or is_datacenter is true, the location belongs to an intermediary and should be treated accordingly — which is also the basis of most geo-velocity fraud detection rules.

How to Look Up IP Geolocation Yourself

One request returns everything discussed above. The IP geolocation API takes an IPv4 or IPv6 address and returns location, timezone, ISP, ASN, and the anonymizer flags together:

curl "https://ip-api.io/api/v1/ip/78.55.53.58?api_key=YOUR_API_KEY"

const res = await fetch(
  "https://ip-api.io/api/v1/ip/78.55.53.58?api_key=YOUR_API_KEY"
);
const { location, isp, asn, suspicious_factors } = await res.json();

// Trust the country; treat the city as a hint
console.log(location.country);  // "Germany"
console.log(location.city);     // "Berlin"
console.log(isp, asn);          // "Telefonica Germany" "AS6805"

// And check whether the location belongs to an intermediary
if (suspicious_factors.is_vpn || suspicious_factors.is_datacenter) {
  // the address is not where the human is
}

For many addresses at once — backfilling a table of historical events, or scoring a day's signups in one pass — use bulk IP lookup, which accepts up to 100 addresses per request and returns the same fields for each.

Privacy and Compliance

In the EU, an IP address is personal data under GDPR, and the Court of Justice has held this even for dynamic addresses. Looking one up is therefore processing that needs a lawful basis — commonly legitimate interest for fraud prevention and security, or consent for personalization and analytics. Using a third-party API rather than a local database does not change your obligations; it adds a processor to document.

Practically, that means deciding and writing down your lawful basis, keeping addresses only as long as the purpose requires, and being able to say where they are processed. Country-level lookups for compliance and security tend to sit comfortably within legitimate interest; building long-term location profiles of identified users does not.

Conclusion

IP geolocation is best understood as a well-informed estimate assembled from registry records, ISP-published geofeeds, routing data, and latency measurement. That construction explains both its strength — near-perfect country attribution with no user involvement at all — and its ceiling, which is a city rather than a street. Use the country level to make decisions, use the city level as a signal, and always check the anonymizer flags before believing either.