The uses that actually work
Almost everything written about IP geolocation is about it failing. Here is where it succeeds, and what separates the two.
Content delivery, the case it was built for
A content delivery network keeps copies of a site in many locations and answers each request from a nearby one. Deciding which one is near you is the single largest use of IP geolocation by volume, and it works well.
In practice most networks lean on anycast rather than a database lookup: the same address is announced from many locations at once, and ordinary internet routing carries your packets to whichever is closest in network terms. That is better than a geolocation guess, because it measures the thing that actually matters, which is network distance rather than physical distance.
This site is served that way. Our front page comes from whichever CloudFront edge is nearest you, and the geolocation shown to you comes from headers that same edge adds.
Fraud scoring, where it is one signal among many
Payment and login systems weigh location, and the useful part is rarely the city. What matters is:
- Country, and whether it matches the account and the payment method.
- Connection type, meaning residential, mobile, business or data center. A sign-in from a hosting provider is unusual for a consumer account.
- Change over time. Two logins an hour apart from places a person could not travel between is a strong signal, and it needs no precision at all.
Notice that all three tolerate a wrong city. A system built on the country and the shape of the change works; one that flags you for being in the next town over does not, and mostly annoys real customers.
Not because a VPN is suspicious in itself. It hides the signals the system relies on, so the score falls back to the fallback, which is more friction. That is the mechanism behind the extra code you get asked for after connecting to a tunnel.
Compliance, where the rule is about place
Some obligations genuinely attach to where a person is, and geolocation is how a website applies them.
| Obligation | What it drives |
|---|---|
| GDPR and similar privacy law | Which consent banner you see, and what it must ask |
| Sales tax and VAT | Which rate applies, and whether tax shows in the price |
| Sanctions | Whether a service may be offered at all |
| Gambling licensing | Per-jurisdiction, and enforced strictly |
| Age verification rules | Varies by country and increasingly by state |
Country accuracy is high enough for most of this, which is why these systems work tolerably. The exception is anything decided at state or regional level, where the accuracy available is materially worse than the rule assumes. That gap is a real and growing problem, and it is one people rarely notice until it affects them.
The pattern that separates good uses from bad
Having gone through the uses, the distinction is easy to state.
| Good use | Bad use | |
|---|---|---|
| Precision needed | Country or region | City or finer |
| Being wrong costs | Milliseconds, or a mild annoyance | Access to something paid for |
| Failure mode | Degrades gently | Denies outright |
| Can the user correct it? | Yes, by overriding a default | No, and often no way to appeal |
| Is it the only signal? | No, one of several | Yes |
Routing, currency defaults and fraud scoring sit in the left column. Denying a person access on a city-level guess sits in the right, and it is asking more of the technology than it can deliver at the accuracy it actually achieves.
If you are building something with it
- Use it for defaults, never for gates, unless the gate is genuinely a legal obligation at country level.
- Always allow an override. A currency or language picked for someone should be changeable in one click, and the choice should stick.
- Do not use city-level data for anything consequential. It is right about half the time, and half your users are not who you think.
- Treat mobile and data-center addresses as unknown rather than as located. Carrier aggregation makes their answer close to meaningless.
- Say it is approximate where you show it. We put that caveat next to our own map for exactly this reason.