Type "what is my IP location" into a search engine and you get a page that names your city. Sometimes it is right. Sometimes it is a hundred miles off. Occasionally it names a city in a country you have never visited.
That inconsistency is the interesting part, because it reveals something people usually miss: IP geolocation is only one of at least seven ways a website can work out where you are, and it is nowhere near the most accurate. Some of the others are precise to a few metres. Most of them survive a VPN completely untouched.
This matters in both directions. If you are trying to control what sites see, you need to know which signals your tool actually covers. If you are testing how your own site behaves in different countries, you need to know which signals to change to get a realistic test.
We are Geonode, a residential proxy provider, so treat the proxy sections with appropriate scepticism — and note that we are explicit about the limits, because a proxy addresses roughly two of the seven methods below and leaves the rest alone. That gap is where most people's setups quietly fail.
IP Geolocation and Its Limits
The method everyone knows, and the one most misunderstood.
How It Works
Every connection carries a source IP address. That is unavoidable — without it, nothing could be sent back.
IP addresses are allocated in blocks to organisations, and those allocations are public through the regional internet registries. A block assigned to a Portuguese ISP is presumably being used in Portugal. Commercial geolocation databases start there and refine with additional data: routing information, network latency measurements, ISP-published records, and user-submitted corrections.
A site looks your address up in one of these databases and gets a country, a region, a city, and coordinates.
How Accurate It Actually Is
Accuracy degrades sharply as precision increases:
| Level | Typical reliability |
|---|
| Country | High — usually correct |
| Region or state | Good in large markets, weaker elsewhere |
| City | Mixed — often the wrong city in the right area |
| Coordinates | Frequently meaningless |
The coordinates deserve particular scepticism. When a database knows the country but not the city, some return the geographic centre of the country as a placeholder. This is why certain rural locations have historically received enormous volumes of misdirected attention — they happened to sit at a national centroid that a widely used database returned as a default. Those coordinates never meant a specific house. They meant "somewhere in this country".
The rule worth remembering: IP geolocation is reliable for country and unreliable for anything finer. Sites that use it for content licensing or currency selection are using it appropriately. Sites that claim to pinpoint your street are overstating what the data supports.
Why IP Databases Get It Wrong
Understanding the failure modes explains most of the odd results people see.
Mobile carrier NAT. Cellular networks route enormous numbers of subscribers through shared address pools, often anchored at regional gateways. Your phone can appear to be in a city hundreds of kilometres away because that is where the carrier's gateway sits. Mobile IP geolocation is substantially less reliable than fixed-line.
Corporate networks. A company routing all offices through one central egress point makes every employee appear at headquarters, regardless of which country they are actually in.
Reassignment lag. Address blocks get transferred between organisations and regions. Databases update on their own schedules, so a block that moved from one country to another can be misreported for months.
Satellite and rural ISPs. Ground station locations rather than subscriber locations.
VPNs and proxies. By design — you see the intermediary's location.
Database disagreement. Different providers hold different data. This is easy to verify: check your own address on three lookup services and you will frequently get three different cities. None of them is lying; they are guessing from different inputs.
That last point is the practical one. If lookup sites disagree about you, they disagree about everyone, and any system depending on city-level IP accuracy is building on sand.
Browser Geolocation
This is the accurate one, and it works completely differently.
The Permission Prompt
When a site asks for your location and the browser shows a prompt, it is requesting the Geolocation API. If you allow it, your device determines its own position and hands over coordinates.
On a phone this means GPS, accurate to a few metres outdoors. On a laptop, it typically means Wi-Fi positioning: the device sees nearby wireless networks and looks their identifiers up in a database of known network locations. That is often accurate to within tens of metres in populated areas — dense Wi-Fi makes for precise positioning.
What This Means for Proxies
A proxy or VPN does absolutely nothing here.
The location comes from your device's own sensors, not from your network path. Route your traffic through a server in Singapore, grant the permission, and the site learns your actual coordinates in your actual city. The two systems do not interact at all.
This is the single most common way a careful setup gives itself away — someone configures a proxy correctly, then clicks "Allow" on a location prompt out of habit.
The Defence
The permission is the control point, and it is entirely yours. Deny it, or set your browser to block location requests by default and grant per-site where you genuinely want it — maps and delivery services being the obvious cases.
No site can read your coordinates without that permission. The prompt is not a formality; it is the whole security model, and it is a good one.
The Signals You Forget About
Between the coarse method and the precise one sits a set of signals people rarely think about, all readable without any permission at all.
Timezone
JavaScript can read your system timezone directly. America/Sao_Paulo is considerably more specific than a country — it names a region.
This is the classic contradiction. A connection from a Brazilian IP address reporting Europe/Kyiv is not a Brazilian user. Detection systems check this pairing specifically because it is cheap to test and catches naive setups immediately.
Language Settings
Your browser sends an Accept-Language header on every request, listing your preferred languages in order. Your system locale is separately readable from JavaScript.
A German-language browser on a Japanese IP is possible — people travel, people emigrate — but it is unusual enough to notice, and combined with other mismatches it becomes conclusive.
Wi-Fi and Network Environment
Covered above under browser geolocation, but worth separating: the Wi-Fi networks visible to your device are a location signal independent of your IP address entirely. It requires permission, and it is why laptop geolocation works indoors where GPS does not.
WebRTC
WebRTC exists for peer-to-peer connections and historically could reveal local network addresses and, in some configurations, your real public address even behind a proxy. Browsers have tightened this considerably, but leak testing remains worthwhile because the failure is total when it happens — one request undoes everything else.
Currency, Units, and Formats
Date format, number format, measurement units, and default currency all derive from locale settings and all narrow the field.
The Point
None of these requires a permission prompt. All are readable on page load. And a proxy changes none of them — they come from your device configuration, not your network path.
A proxy without matching timezone and language is a contradiction that flags faster than not using a proxy at all.
Behavioural and Account Signals
The layer that no technical configuration touches.
Your account. If you are logged in, the platform knows everything it has ever learned about you — including every location you have ever connected from. A single session from a different country against months of consistent history is an anomaly, not a disguise.
Payment methods. Card issuing country, billing address, and the payment processor's own fraud signals. This is why streaming and retail geo-restrictions survive VPNs: the payment step is the check that matters.
Delivery addresses. Self-evident, and definitive.
Activity timing. When you are active maps to a timezone. Someone claiming to be in Tokyo whose activity follows European working hours has said something about themselves that no header controls.
Social graph. Who you interact with and where they are.
Historical consistency. Platforms retain location history. Sudden jumps between distant countries are exactly what fraud detection looks for.
This category is worth stating plainly: for a logged-in account, network-level tools are close to irrelevant. The platform is not asking where your packets came from. It is looking at everything it knows about the account, and your packets are one small input.
What a Proxy Actually Changes
Here is the honest accounting. Seven methods, and what a proxy does about each.
| Method | Does a proxy change it? |
|---|
| IP geolocation | Yes — this is the whole function |
| Regional access blocks | Yes — the site sees the proxy's location |
| Timezone | No — set it yourself |
| Language headers | No — set them yourself |
| Browser geolocation API | No — deny the permission |
| WebRTC leaks | Only if configured to |
| Account and payment history | No |
Two rows out of seven, plus one that depends on configuration.
What That Is Good For
The two rows are genuinely useful for specific jobs.
Testing your own site from other countries. This is the clearest legitimate case. If your site serves different content, currencies, or prices by region, you need to see what a user in that region sees. A residential proxy in the target country shows you exactly that.
Ad verification. Confirming campaigns render correctly to the intended audience.
Price and availability monitoring. Retail and travel pricing varies by region, and comparing requires appearing to be in each one.
SERP checking. Search results differ by location; checking rankings for a market means querying from it.
Making the Rest Agree
If you want a coherent picture rather than just a different IP:
- Set the browser timezone to match the proxy's country
- Set
Accept-Language and system locale to match
- Deny geolocation permission requests
- Test for WebRTC leaks explicitly
- Use a clean browser profile without existing cookies
Skip any of these and you have produced a contradiction rather than a disguise. That is worse than doing nothing, because contradictions are what detection systems are specifically built to find.
Cost
For testing and monitoring, volumes are modest — a page of HTML is 50–200 KB. Geonode starts at $0.79/GB with 1 TB free for new accounts, dropping to $0.50/GB at 100 GB. Market rates run from $0.79 to $7.00 per GB, so it is worth checking what you are paying if you use a provider at the upper end.
Checking Your Own Setup
Whatever your reason for caring, verifying beats assuming. Each check takes seconds.
Look yourself up in several databases. Use three different IP lookup services and compare. The disagreement between them tells you how much confidence any single one deserves — usually less than people assume.
Compare your timezone to your IP. Open the browser console and run Intl.DateTimeFormat().resolvedOptions().timeZone. If it contradicts your apparent country, you have the most common mismatch.
Check your language headers. Any header-inspection page shows what Accept-Language you are sending.
Test for WebRTC leaks. Dedicated leak-test pages will tell you whether your real address is exposed underneath a proxy or VPN.
Audit your geolocation permissions. In browser settings, review which sites you have granted location access to. Most people find entries they do not remember approving.
Check DNS. DNS queries can escape a proxy and reveal your resolver's location. Leak-test tools cover this too.
Running all six takes about two minutes and finds most of the ways a setup silently fails.
The Legitimate Side of This
Location detection is not adversarial by default, and most of its uses are ordinary.
Content licensing. Media rights are sold by territory, and platforms are contractually obliged to enforce that. It is a legal constraint, not a technical preference.
Currency and tax. Showing prices in local currency and applying the correct VAT rate requires knowing the country.
Fraud prevention. A card used in one country and a login from another is a real signal, and location checks prevent a meaningful amount of fraud.
Regulatory compliance. Data protection, gambling, and financial regulations differ by jurisdiction, and services have to apply the right rules.
Legitimate personalisation. Local store hours, delivery estimates, regional languages.
Where the Line Sits
Terms of service still apply. Circumventing regional restrictions frequently violates them. Testing your own site is different from evading a licensing restriction on someone else's.
Fraud remains fraud. Misrepresenting location to obtain something you are not entitled to is not a technical question.
Data protection law applies to location data as personal data, with a lawful basis required for collection and processing.
Accuracy claims deserve scrutiny. Any product claiming street-level accuracy from an IP address alone is overstating what the underlying data supports. That matters if decisions are being made from it.
People Also Ask
How accurate is IP location?
Usually correct at country level, considerably less so for city, and often meaningless for coordinates. When a database knows the country but not the city, some return the country's geographic centre — which is why some lookups appear to point at a specific rural spot that has nothing to do with anyone.
Can websites see my exact address from my IP?
No. IP data does not support street-level accuracy. A site can get precise coordinates through the browser Geolocation API, but only if you grant permission when prompted. That prompt is the control point.
Does a VPN hide my location?
It changes what your IP address says about you, which handles IP-based checks and regional blocks. It does not change your timezone, language settings, browser geolocation, or anything a platform knows about your account. Those are separate signals and they leak independently.
Why do different IP lookup sites show different cities?
Because they use different databases built from different inputs, updated on different schedules. None is authoritative. The disagreement is the honest signal about how precise this method really is.
Why does my IP show the wrong city?
Commonly mobile carrier routing (your traffic exits at a regional gateway), corporate VPN egress, an address block that was reassigned faster than databases updated, or a satellite or rural ISP whose ground station is elsewhere.
Can sites detect my location if I deny permission?
They can still estimate it from your IP address, timezone, and language settings — coarsely. They cannot get GPS-level coordinates without the permission you denied.
What is the most reliable way to control what sites see?
Make the signals agree. A proxy in the target country, a matching timezone, matching language settings, geolocation permission denied, and no WebRTC leak. Any one of those left inconsistent undoes the others.
Wrapping Up
Websites have at least seven ways to work out where you are, and they are not equivalent.
IP geolocation is the one everyone knows and the least precise — dependable for country, unreliable for city, frequently meaningless for coordinates.
Browser geolocation is the accurate one, precise to metres, and gated entirely behind a permission prompt that no proxy affects.
Timezone, language, and locale leak continuously, need no permission, and are the most common way a proxy setup contradicts itself.
Account, payment, and behavioural history sit outside network configuration altogether. For a logged-in account, they are what actually decides the question.
A proxy covers two of the seven. That is not a small thing — for testing how your site behaves in another market, or checking search results and pricing by region, it is exactly the right tool. But it is two of seven, and treating it as a general location control is how people end up with setups that broadcast a contradiction instead of a plausible identity.
If you want the signals to agree, set the timezone, set the language, deny the location prompt, and test for leaks. Two minutes of verification tells you more than any amount of assuming.
