How Accurate Is IP Geolocation? What the Independent Research Actually Shows (2026)

"How accurate is IP geolocation?" is one of those questions where the honest answer is "compared to what?" Country, region, and city are three completely different accuracy regimes. Most of the confusion, and most of the bad product decisions, come from collapsing them into a single number.

This guide answers the question with the independent, peer-reviewed evidence rather than marketing claims. Where a number comes from a provider grading its own data, we say so; where it comes from academic research checking IP locations against real GPS coordinates, we cite the study. That distinction is the whole point.

The Short Answer: Accuracy by Geographic Level

Accuracy collapses as you zoom in. Here is the landscape, with vendor self-reports and independent measurements side by side:

The country tier is genuinely dependable because the regional internet registries (RIRs) allocate large address blocks that almost always sit within one country. An independent active-measurement engine (RIPE IPmap, analyzed by CAIDA) reached 99.58% country-level accuracy. Even the lower independent figures for free databases are strong enough for country-based decisions: 70-90%, per the peer-reviewed measurement of router IPs by Gharaibeh et al. (ACM IMC 2017), summarized by APNIC.

City is a different story, and this is where the marketing and the measurements diverge most.

What "City-Level Accuracy" Really Means

When a data provider says it locates 66% of U.S. IPs "within 50 km," read that carefully: a 50-km radius is an entire metro area, not a city block. And that 66% is the provider's own estimate of its own data. When independent researchers check IP locations against real GPS ground truth, the picture is harder:

• Dan, Parikh & Davison (IEEE/ACM Transactions on Networking), testing against a 27-million-hostname set, measured median city-level errors of 11.1 km and 16.7 km for two leading commercial providers, and 43.7 km for reverse-DNS methods. The very large RMSE means a heavy tail of much bigger misses.
• A peer-reviewed IEEE Transactions on Mobile Computing study using 2020-2021 GPS data found median errors of ~13.6-18.9 km, with only 10.6-12.1% of samples within 1 km and up to 24% off by more than 100 km.
• Saxon & Feamster (PAM 2022) concluded bluntly that relying on IP geolocation "in densely populated regions such as cities is premature."

So the realistic mental model for city-level IP geolocation is: a best guess at a metro area, with a real chance of being in the wrong city entirely. That is fine for "show prices in the right currency" and dangerous for "block this user because they appear to be in the wrong town."

How IP Geolocation Actually Works

No single signal can place an IP, so providers combine several. That blending is also why accuracy varies so much:

• Registry allocation (RIR / WHOIS): the foundational layer. RIRs assign blocks to networks, which reliably gives country and often region.
• ASN and BGP routing: which autonomous system announces the address, and how it's routed, narrows the network's footprint.
• Reverse DNS: hostnames sometimes encode a city or airport code. Useful but noisy (median ~43.7 km error on its own, per the ToN study above).
• Latency-based active measurement: converting network round-trip times into distance from known reference points. The RIPE IPmap method pings from probes topologically close to the target. CAIDA measured its median error at 6 km but its 95th-percentile error at 344 km: precise near interconnection points, unreliable far from them.
• Crowdsourced GPS-to-IP signals: real device coordinates paired with the IP they used. This is the strongest signal for city-level precision and the basis of the academic ground-truth datasets above.

The honest version of "how it works" is that databases blend these into a best estimate plus an accuracy radius, and the size of that radius is the part most teams ignore.

Why Accuracy Degrades, and for Whom

A single global accuracy number hides enormous variation. As even the largest providers acknowledge, accuracy "exhibits high variability according to country, distance, type of IP (cellular vs. broadband, IPv4 vs. IPv6), and practices of ISPs." The big degraders:

• Mobile and cellular IPs. The worst case by far. A 2026 measurement study found median errors of 179-207 km on mobile networks versus 3-16 km on fixed networks, more than 10x worse, because carriers assign the public address at a central gateway, not at the device. (This figure is from a recent preprint; treat the exact numbers as indicative, but the ~10x gap is consistent across the literature.)
• CGNAT (Carrier-Grade NAT). One public address fronts thousands of subscribers across a wide area. You cannot meaningfully "city-locate" a CGNAT IP, and blocking one punishes a crowd.
• VPNs, proxies, and Tor. These deliberately relocate the apparent IP. The right response is to detect the anonymizer and score accordingly instead of trusting the geolocation; see our guide on detecting anonymized traffic without blocking real customers.
• Apple iCloud Private Relay. Legitimate, paying users whose traffic egresses through a relay that preserves only the approximate region, not the city. Treating that as suspicious blocks real customers.
• Dynamic reassignment and IP leasing. ISPs reassign addresses, and blocks change hands through the growing IPv4 transfer market, often faster than registry records and databases catch up.
• IPv6. Generally underperforms IPv4 in independent testing, as databases have thinner ground truth for it.

The Freshness Problem Nobody Advertises

Here is the factor that quietly wrecks accuracy: time. A geolocation database is a snapshot. The moment an ISP reassigns a range, leases a block to a company in another country, or repurposes mobile prefixes, every static database is wrong until its next update, and most update on a slow cadence. An address that was a home in Chicago last quarter can be a data-center range in Frankfurt this quarter.

This is why the most useful question is not "which city is this IP in?" but "how confident are we, and when was this last verified?" Geolocation that is continuously re-verified against live network evidence beats a stale lookup table, even a well-regarded one. It's a principle we apply across GeoIPHub's methodology.

How Much Accuracy Does Your Use Case Actually Need?

The good news: most real use cases don't need city-level precision, and the ones that think they do usually shouldn't rely on it. Country and region rules, such as IP geofencing for access and localization or enforcing territorial content licensing, sit at the resolution the data handles best.

The recurring failure mode is over-blocking: hard-denying a user because an IP appears to be in the wrong city, when that user is simply on a phone, behind CGNAT, or on a privacy relay. Because IP geolocation is inherently imprecise, a city-level hard block is a false-positive machine pointed at your real customers.

IP Geolocation Accuracy by Industry

The resolution you need, and the cost of over-trusting a city, shifts with what you're protecting. Here is how the same accuracy ceiling plays out across the industries that ask about it most:

The pattern repeats in every vertical: country and region carry the decision; city is context, not evidence. In fintech and account security especially, the expensive mistake is reading a city mismatch as fraud when the user is simply on a phone. Pair geolocation with connection type and an IP fraud score threshold rather than blocking on location alone.

Best Practices: Use the Radius, Not the Pin

If you take one thing from the research, make it this: design for uncertainty.

• Use the accuracy radius and confidence score, not just a city name. Every lookup should carry how sure it is. A low-confidence city is a hint, not a fact.
• Match resolution to the decision. Use country/region for anything consequential; reserve city for low-stakes personalization that fails gracefully.
• Combine signals. Pair geolocation with connection type, VPN/proxy/residential-proxy detection, and behavior. One signal should never trigger a hard block.
• Special-case mobile, CGNAT, and Private Relay. Detect them and relax geographic strictness instead of penalizing the connection type.
• Never locate a person. Use IP for approximate, aggregate, probabilistic decisions; never to identify a household or individual.

This is exactly why GeoIPHub returns more than a city string on every lookup. You get the connection type, anonymizer flags, and a confidence signal, so you can weight the location instead of blindly trusting it:

Illustrative values, not a real lookup (field names and structure match the live API; we don't publish lookups of real household IPs):

A residential connection with a solid geo_confidence and no anonymizer flags can be trusted for region-level decisions. A mobile connection (detection.is_mobile), a CGNAT range (threat.is_cgnat), an anycast address, a relay, or a low geo_confidence tells you to ease off on geography and lean on other signals. You can try this on any address with the free IP lookup tool or what-is-my-IP, or read the full API reference.

The Honest Limits

Let's be candid in a way most provider blogs aren't: there is a ceiling on city-level IP geolocation accuracy that no vendor can market its way past. Paid databases are not always meaningfully better than free ones for city precision (Saxon & Feamster). The hardest IP types (mobile, CGNAT, infrastructure) will keep producing large errors, and the IPv4 transfer market keeps eroding yesterday's ground truth. Anyone promising pinpoint, street-level accuracy from an IP alone is selling the marketing number, not the measured one.

That isn't a reason to dismiss IP geolocation. It's the most scalable location signal on the internet and genuinely excellent at country and region. It's a reason to use it honestly: as a probabilistic, radius-based signal, continuously verified, combined with others, and never asked to do more than it can. Used that way, it's one of the most useful signals in fraud prevention and personalization. Used as a pinpoint, it quietly blocks your real customers.

Trust the Country, Read the City as a Radius

How accurate is IP geolocation in 2026? Near-certain at the country level, solid at the region level, and approximate at best at the city level. Mobile, CGNAT, and privacy-relay traffic drag city precision down hard. Build for that reality: read the confidence and the connection type, not just the city; match resolution to the stakes; and treat every city as a radius, not a pin.

Frequently Asked Questions

How accurate is IP geolocation?

It depends entirely on the resolution you need. Country-level accuracy is very high: providers self-report ~99.8%, and independent active measurement reaches ~99.6%. Region/state level is roughly 80%. City level is the weak point. Peer-reviewed studies that check IP locations against real GPS coordinates find median errors of about 11-18 km, with only ~10-12% of addresses placed within 1 km and a long tail of errors over 100 km.

Is IP geolocation accurate enough to find someone's exact address?

No. IP geolocation is inherently imprecise and should never be used to locate a specific individual or household; even the largest data providers state this explicitly. It estimates an approximate area (a city, region, or accuracy radius), not a street address. Treating it as pinpoint location is the single most common and most damaging mistake.

Why is city-level IP geolocation so much less accurate than country-level?

Country works because regional internet registries allocate large IP blocks that almost always sit in one country. Pinning a city requires inferring where inside that block an address physically is, and that depends on stale registry data, ISP routing choices, and signals like latency that don't map cleanly to streets. Mobile, CGNAT, VPN, and dynamically reassigned IPs make it harder still.

How accurate is IP geolocation on mobile and CGNAT networks?

Much worse, roughly 10x worse than fixed-line broadband. A 2026 measurement study found median errors of 179-207 km on mobile networks versus 3-16 km on fixed networks, because carriers assign addresses at a central gateway and place many subscribers behind one Carrier-Grade NAT address. Never hard-block or hard-localize a mobile/CGNAT IP at city granularity.

How is IP geolocation accuracy measured?

As the percentage of IP addresses located within a given accuracy radius, checked against known IP-to-location pairs. The honest version uses independent ground truth (real GPS coordinates from devices) rather than a provider grading its own homework. Vendor 'accuracy radius' figures are upper bounds; independent GPS studies consistently report larger real-world errors.

What should I use IP geolocation for, and what should I avoid?

Good uses: country/region-level fraud and risk signals, broad content localization, coarse compliance, and flagging mismatches. Risky uses: anything that hard-blocks or penalizes a user based on a precise city, especially for mobile/CGNAT/privacy-relay traffic. Use an accuracy radius and confidence score, combine signals, and degrade gracefully instead of over-trusting a single city.