IP-based Geolocation Tracking

IP-based geolocation is basically a lookup system that maps an internet connection to an approximate physical area. 

It’s widely used, but it’s important to understand what it can and can’t do.

How it works

When you connect to a service, your device uses an IP address (e.g. something like 82.xxx.xxx.xxx). 

That IP is assigned by your internet provider (ISP).

Geolocation databases (run by companies like MaxMind, IP2Location, etc.) map IP ranges to locations using:

• ISP registration data (who owns that block of IPs)

• Routing information (where traffic enters major internet hubs)

• Data from Wi-Fi/mobile networks (crowdsourced or licensed)

• Previous user/device location signals (in some cases)

So instead of “tracking you,” it’s more like:

“This block of IPs is usually used in or around Manchester.”

How accurate it is

It varies a lot:

• City-level (like Manchester): often fairly accurate, but not guaranteed

• Wrong city but correct country: common

• Completely wrong region: happens, especially with mobile networks or VPNs

• Exact street/address: not possible from IP alone

Mobile carriers and VPNs make it less reliable because traffic may route through central hubs (e.g. London) even if you’re elsewhere. 

Why it exists

Systems use it mainly to:

• switch between UK/US spelling and norms

• give relevant local results (weather, shops, services)

• improve safety and fraud prevention at a platform level

It’s not precise enough to identify you personally in most cases. It’s not direct surveillance — it’s database inference from network routing

VPNs (Virtual Private Networks) and modern browser/location tricks basically work by separating where you are physically from where your internet traffic appears to come from.

Here’s how they interact with IP geolocation and other tracking methods.

How a VPN changes your location

When you use a VPN:

• Your device connects to a VPN server (e.g. in London, Amsterdam, New York).

• All your internet traffic is routed through that server.

• Websites and services only see the VPN server’s IP address — not yours.

So instead of:

“User is in Manchester”

They see:

“User is in London (VPN exit node)” — or wherever the server is.

This is why VPNs are so effective at breaking IP-based location systems.

Why VPNs confuse geolocation databases

IP geolocation relies on databases that assume:

“This IP range belongs to ISP X in region Y”

VPNs deliberately use IP ranges that:

• are hosted in data centres

• are reused by many users

• are not tied to physical residential locations

So databases often:

• mislabel them as major cities (London, Frankfurt, etc.)

• or flag them as “hosting/VPN/datacentre traffic”

Other ways websites detect your location (beyond IP)

Even with a VPN, sites can still estimate location using:

1. Browser location (most accurate if allowed)

If you permit it, browsers can use:

• Wi-Fi network scanning

• nearby cell towers (on mobile)

• GPS (phones)

This can be accurate to tens of metres.

2. Time zone and language settings

Websites compare:

• system time zone (e.g. GMT)

• browser language (en-GB vs en-US)

• keyboard/layout settings

This doesn’t pinpoint you, but it helps “sanity check” location.

3. WebRTC leaks (sometimes)

Even with a VPN, browsers can accidentally expose:

• local network IPs

• sometimes real public IP (if misconfigured)

Modern browsers reduce this, but it’s still a known issue.

4. Account history and behaviour

If you’re logged into services:

• previous logins

• usual login locations

• payment region

These can override IP-based assumptions entirely.

Can VPNs fully hide location?

Not perfectly.

They are very good at hiding:

• real IP address

• approximate city-level location from IP

But they don’t automatically hide:

• browser-based location (if you allow it)

• behavioural patterns

• account-linked location history

Simple mental model

IP geolocation = guess based on network ownership

VPN = you’re borrowing someone else’s “return address” on the internet

Browser GPS/Wi-Fi = actual physical positioning (if enabled)

Leak Testing

Alright—this is where it starts to get a bit more technical, because modern sites don’t rely on just one signal. They combine several weak signals into something surprisingly accurate. 

1) IP leak tests (what they actually check)

An “IP leak test” doesn’t just show your IP—it checks whether your real connection is accidentally escaping your VPN.

Typical tests look at:

Public IP

What websites see as your address (should be VPN server if everything is working).

DNS leaks

When you load a site, your device asks:

“Where is this domain located?”. If those DNS requests go to your ISP instead of the VPN provider, your real network can be inferred.

WebRTC leaks

Browsers can try to find the fastest route for calls/streaming and may reveal:

• local IP addresses

• sometimes the real public IP (if misconfigured)

IPv6 leaks

If VPN only handles IPv4 but your device uses IPv6, traffic may bypass the VPN.

Why leak tests matter

They don’t “hack” anything—they just verify:

“Are all network paths actually going through the VPN tunnel?”

If even one path bypasses it, your real location can be partially exposed.

Browser fingerprinting (the big one)

Even without IP, websites can identify you quite reliably using a “fingerprint.”

This is a combination of small details like:

• Device + browser traits

• operating system (Windows, macOS, Linux)

• browser version

• installed fonts

• screen resolution

• GPU type

• Rendering behaviour

A canvas or WebGL test asks your device to draw an image. Subtle differences in:

• graphics drivers

• hardware

• browser engine

...produce a near-unique “signature.”

Audio fingerprinting

Yes—some scripts analyse how your device processes sound signals.

• Time + language

• time zone (GMT, CET, etc.)

• preferred language (en-GB, en-US)

Key idea to fingerprinting

Even if your IP changes, your fingerprint can often stay the same.

So sites can say:

“This looks like the same device that visited yesterday.”

How accurate location can get without GPS

Even without explicit permission, combining signals can get surprisingly close:

Step 1: IP gives rough area

Often city or region (e.g. Manchester / Northwest England)

Step 2: ISP routing refines it

Some ISPs have known infrastructure hubs

Step 3: Wi-Fi positioning (if partially available)

If your device scans nearby Wi-Fi networks, databases like Google’s can match them to known physical locations.

Step 4: Behavioural correction

login history (“you usually log in from X”)

typical time patterns

payment region

Result accuracy

VPN only: usually wrong city, correct country

IP + fingerprinting: often correct region

GPS/Wi-Fi allowed: accurate to street level or better

How all of this gets combined

Modern tracking systems don’t rely on one method. They use probabilistic matching:

“Given IP says Manchester, fingerprint matches previous device seen in Manchester, time zone matches GMT → high confidence user is in Manchester.”

Or with a VPN:

“IP says Frankfurt, but fingerprint + time zone + behaviour match UK user → likely VPN exit node.”

What actually breaks tracking (and what doesn’t)

VPN helps:

• hides real IP

• changes apparent country/city

• defeats simple geolocation

VPN does NOT fully stop:

• fingerprinting

• account-based tracking

• browser-based location (if enabled)

Incognito mode:

• only stops local history

• does NOT hide fingerprint or IP

The important takeaway

Modern “location detection” is not one thing—it’s:

IP inference + device fingerprint + behavioural modelling + optional GPS

So even when one signal is wrong (like VPN IP), the others often correct it.