The IP address is compared to paid IP geolocation databases, so if the ISP (Internet Service Provider) has updated their IP addresses and this data hasn’t been updated in the IP geolocation database, then this can be a source of inaccuracy. Also, IP addresses inherently inaccurate to some degree (please see the next question).
What is IP geolocation?
An IP address is a unique identifier for each connection to the internet. Note ‘each connection’ not ‘each user’. Using IP lookup, each IP address can be detected, but these can change. So this approach isn’t going to enable the detection of individual users.
When a device connects to a network, it will be assigned a private IP address. The private IP address is used to give a unique identifier or particular IP address to every device on a network. For example, at home, this could be a PC or games console, a laptop or tablet, a phone, or IoT (Internet of Things) device. Any one of these then gains access to the internet through the router. Barring instances of security breaches, these private IP addresses will remain private.
The router is assigned a public IP address which enables every device on the network to connect to the internet through the same IP address. This is the IP address that can be detected and traced with IP geolocation.
Data on IP addresses is sourced from ISPs and held in a IP geolocation database. IP geolocation enables this data to be pulled from the database and then used to address a wide range of use cases. This information can span everything from country to city to latitude/longitude to ISP.
How does IP geolocation work?
An IP lookup can be used to detect an IP address using an IP geolocation API, for example by using PHP. This API will then compare the IP address to the IP geolocation database it’s connected to which will enable it to get more detailed information (this information is provided to databases by ISPs).
This data is then sent through the API so that the services it’s integrated with can source this information. For example, online stores will frequently source local language and currency so that it can show customers content in their language and prices in their own currency.
IP geolocation accuracy levels
As mentioned above, accuracy is variable across country, region and city. Also, if one database isn’t updated as frequently as others, you can see disparities between different IP geolocation APIs.
The quality of the accuracy of IP geolocation depends on which database is being used; these vary from region to region. There are five major IP geolocation databases:
- African Network Information Centre (AfriNIC)
- American Registry for Internet Numbers (ARIN)
- Asia-Pacific Network Information Centre (APNIC)
- Latin American and Caribbean Internet Address Registry (LACNIC)
- RIPE Network Coordination Centre (RIPE NCC)
The accuracy of an IP address will vary largely from country to country. In parts of the world where there are many smaller countries, there is a higher chance that you get a false match on a specific country. In places like the U.S., it is almost always going to be accurate. Overall, the likelihood that your country match is accurate is about 95-99%.
However, when you start breaking it down to city level, the accuracy of the exact location of the user becomes far more variable. This is because the IP address that is identified is coming directly from a user’s Internet Service Provider (ISP). Most IPSs make use of dynamic IP addresses, particularly if they are relying on IPv4, of which there are a limited number of distinct addresses. This means that they may be using a random IP from a nearby town or city which may or may not be accurate as to where an individual who is accessing a site is physically located.
The information provided to the querying user is likely to be accurate to where the specific node exists, but not necessarily the exact location of the user. As a result, in order of accuracy, you will most likely get the correct country, but not necessarily the correct city or town (though it may within a reasonable range of distance), and almost certainly not the exact physical address of the user. If a user is attempting to access your site from a business, the results are more likely to be accurate, as many companies make use of static IP addresses.
Also, many IP geolocation services segment their products into different tiers. Some vendors will segment their database by the number of API calls they permit per month and frequency ie number per second. However, some will also ‘hide’ greater levels of accuracy behind higher product tiers. For example, a product might not be capable of sourcing IP geolocation data more accurate than country at the level 1 tier with more detailed data only becoming available at level 2 (at a higher cost).
Other challenges to IP geolocation
There are also a range of challenges to sourcing an exact location from an IP geolocation database. These can span everything from IP addresses changing dynamically through to deliberate attempts to hide the IP address.
Content servers
A key component in enabling the provision of low latency services on a global scale is CDNs (Content Delivery Networks). These are servers that deliver content and are distributed across the world. CDNs can serve lots of regions from a relatively narrow set of static IP addresses.
Also, for security reasons, service providers may hide their IP addresses to try to minimize the risk from DDoS (Distributed Denial of Service) attacks which use an artificially high number of connection requests to a server in an attempt to paralyze it.
VPNs and other proxies
Further complicating this is if users use a proxy or VPN. For instance, if a user chooses to use the TOR browser this will mask their access node by bouncing it around the world to many different anonymous proxies. If you are using TOR, you may be accessing the internet from somewhere in the US, but the end-computer may identify it as coming from somewhere in Eastern Europe, or wherever the last TOR node the connection reached before it hit the website is physically located. In other words, using TOR or a wide range of other proxies can seriously mask the location of the user to where it is not even easy to identify the part of the globe where the user is accessing your site. TOR is not the only proxy server out there; there are many that are designed to mask the access point of the user.
Dynamic IP addresses
Many home internet connections have dynamic IP addresses rather than a static IP address. This means that the IP address assigned will change every time the router connects to the internet. So, if a user reboots their router, whether deliberately to try to resolve a tech issue or involuntarily due to a power cut, then when the connection is re-established, it’ll be with a new IP address allocation. So, every ISP will likely have most of its customers cycling through a wide range of IP addresses on an ongoing basis. This is partly a convenience and cost saving measure for ISPs because if a customer moves home, the process of getting them back online in their new home is that much simpler.
As IP addresses cycle between different ISP customers, this means that the geographic location of a single IP address could change in an instant.
Mobile users
You also need to consider mobile. Someone using a laptop may be working from an office in the morning, a museum café wi-fi in the afternoon and from home in the evening. The user hasn’t changed, but they’ll have connected using three different IP addresses. The office location will have a static IP address, the museum IP address may be that of the company providing their IT services and the home IP address could be dynamic.
Also, most internet connections are from smartphones. The mobility of smartphones means that the IP addresses can be changing constantly. Also, while some attempts at IP geolocation of smartphones can be quite accurate, some will also produce the address of the telecoms company whose service the phone is connected to. While this may be a constant at home, it can also change significantly when people travel as roaming is necessary.
However, it is possible to use an API to validate phone numbers.
Poorly updated WHOIS
Identifying where a user is actually located depends largely on a database. As we mentioned with dynamic addresses, the location sometimes changes. Sometimes the location of an IP address moves, so the data that is associated with it, if it has not been updated in whois records, will be inaccurate.
How to improve geolocation accuracy
The more IP geolocation data that can be sourced, the more accurate an individual IP geolocation API is likely to be. To use the example above, if country and region and city are all in alignment, then that increases accuracy.
