How Accurate Is IP Geolocation? A Developer's Guide

IP geolocation maps an IP address to a physical location. It powers content localisation, fraud detection, analytics, and compliance workflows. But it is not GPS — the accuracy varies significantly depending on the IP, the database, and what level of detail you need.

How IP Geolocation Works

Every IP address belongs to an autonomous system (ASN) — a block of addresses assigned to a network operator such as an ISP, university, or cloud provider. Geolocation databases map these blocks to locations using a combination of:

• Registration data — where the IP block was officially registered (ARIN, RIPE, APNIC, etc.)
• BGP routing data — which routers the traffic passes through
• Active probing — direct measurements of round-trip times to known landmarks
• Crowdsourced corrections — user-submitted data from browser geolocation prompts

The Geo & Location Toolkit API uses MaxMind GeoLite2 databases, updated weekly, which aggregate all of the above.

Accuracy by Level

Country Level — Very High

Country-level geolocation is over 99% accurate for most IP ranges. Misattributions are rare and typically involve VPNs, proxies, or satellite internet providers that route traffic internationally before delivering it.

curl "https://geo.toolkitapi.io/v1/geo/ip-lookup?ip=8.8.8.8" \
  -H "X-API-Key: YOUR_KEY"

{
  "ip": "8.8.8.8",
  "country": "United States",
  "country_code": "US"
}

Region / State Level — High

Region-level accuracy is typically 80–90%. ISPs frequently serve customers across multiple states or provinces from a single point of presence, so the IP's registered location may differ from the user's physical state.

City Level — Moderate

City-level accuracy is around 50–75% for residential IPs. The database pinpoints the city where the ISP's POP (point of presence) is located, not necessarily where the user is sitting. For large ISPs, a single POP may serve dozens of surrounding towns.

Postal Code / Street Level — Low

Sub-city accuracy is unreliable. Never use IP geolocation to determine a specific street address or building.

Factors That Reduce Accuracy

VPNs and proxies — Traffic exits the VPN server's data centre, not the user's physical location. The detected location is the VPN server. The Geo & Location Toolkit ip-threat endpoint flags suspected VPN and proxy IPs:

curl "https://geo.toolkitapi.io/v1/geo/ip-threat?ip=203.0.113.42" \
  -H "X-API-Key: YOUR_KEY"

Satellite internet — Providers like Starlink route traffic through ground stations that may be in a different country from the end user.

Mobile networks — Carrier-grade NAT means many users share the same public IP, which geolocates to the carrier's exchange rather than the user.

Corporate networks — Enterprises backhaul traffic through central data centres; a user in London may appear to be in New York.

IPv6 — Geolocation databases have historically had better coverage for IPv4. Coverage for IPv6 is improving but still inconsistent for some ISPs.

How to Get Better Results

Layer geolocation with other signals

IP geolocation works best as a first guess, confirmed by additional signals:

• Browser Geolocation API — With user consent, provides GPS-level accuracy. Falls back gracefully to IP geolocation when declined.
• Accept-Language header — Indicates the user's locale preference, which often correlates with their country.
• Time zone from client — JavaScript's Intl.DateTimeFormat().resolvedOptions().timeZone reveals the device's configured timezone.

Use timezone as a soft country proxy

When city accuracy is insufficient, the timezone field from the IP lookup often narrows the region to a few candidate countries. Cross-reference with the country_code field for a confident result.

{
  "timezone": "America/Chicago",
  "country_code": "US",
  "region": "Illinois"
}

Detect and handle VPNs separately

Rather than trying to geolocate VPN traffic accurately, detect it first and then decide how to respond — whether that means blocking, prompting the user, or relaxing location-based rules:

curl "https://geo.toolkitapi.io/v1/geo/ip-threat?ip=SUSPICIOUS_IP" \
  -H "X-API-Key: YOUR_KEY"

If is_vpn, is_proxy, or is_tor returns true, handle that case explicitly.

Keep database versions current

MaxMind releases GeoLite2 updates weekly. The Geo Toolkit API pulls the latest version automatically, so your lookups always reflect the most recent database without any action on your part.

What to Use It For (and What to Avoid)

Good use cases: - Default currency and language for new users - Approximate time zone for scheduling UI - Fraud signals when IP country doesn't match billing country - Analytics segmentation by country or continent - Blocking or flagging traffic from high-risk regions

Avoid using IP geolocation for: - Legally binding location verification (use GPS + signed attestation instead) - Determining a user's city or street address with high confidence - Compliance when the law requires precise location proof

Summary

IP geolocation is a powerful, zero-friction signal for the right use cases. Pair it with the threat detection endpoint, keep realistic accuracy expectations by level, and layer it with browser signals when precision matters.