IP Geolocation Accuracy: What the Numbers Really Mean
Country, region and city accuracy rates explained, how vendors measure them, and how to validate a geolocation dataset against your own traffic.
# IP Geolocation Accuracy: What the Numbers Really Mean
Every vendor publishes an accuracy figure. Almost nobody publishes the methodology behind it. Before you trust a number, ask what population it was measured on.
Accuracy is a distribution, not a percentage
A claim like "city accuracy within 50 km" is a median. The tail is what hurts you: the 5-10% of lookups that are wrong by hundreds of kilometres because they sit behind a carrier gateway or a cloud NAT. Ask for the 90th percentile error, not the median.
Accuracy varies enormously by network type
- Fixed residential broadband: best case. ISPs allocate pools per region and rarely move them.
- Mobile: poor city accuracy by design. Traffic exits at a small number of national gateways.
- Hosting and cloud: the location is the datacenter, which is factually correct and behaviourally meaningless for the end user.
- Corporate: the location is the office egress, which may be a different continent from the employee.
A single blended accuracy number hides all of this. Segment your evaluation by classification.
How to validate on your own traffic
You already hold the ground truth: shipping addresses, billing postcodes, GPS permissions, timezone headers from the browser. Sample a few thousand sessions and compare.
- Take sessions where the user voluntarily supplied a location.
- Look up the session IP.
- Record country match, region match, and great-circle distance for city.
- Break the results down by classification and by ASN.
Within an afternoon you will know whether the dataset is good enough for your specific audience, which is the only question that matters.
Why live APIs drift less than downloadable databases
Address space moves constantly. Blocks are transferred, leased, re-announced, and re-purposed between VPN and residential use. A database you download monthly is stale from the day it lands. A live API resolves the block at request time and reflects re-allocations within hours. If your fraud rules depend on classification, staleness is not a rounding error, it is the whole game.
Practical thresholds
- Country mismatch alone: log, never block.
- Country mismatch plus hosting classification plus high risk score: worth a challenge.
- City mismatch: analytics only.
Measure, segment, and set thresholds from your own data. That beats any vendor marketing claim.