Websites can pinpoint your location in seconds

You land on an online store for the first time. No account, no login, no cookies. Yet the site already shows prices in your currency, content in your language, and shipping estimates for your country. You did not give it permission. You did not share anything. But the website already knows where you are, and it figured it out before the page even finished loading. Three detection methods make this possible, and most people have no idea any of them exist.

Key takeaways

• Websites use three methods to detect your location: IP geolocation (automatic), browser Geolocation API (requires permission), and Wi-Fi/cell tower triangulation (mobile devices).
• IP geolocation works on every single connection without asking. It identifies your country and approximate city in milliseconds.
• About 1.75 billion people used a VPN as of May 2025, roughly one-third of internet users worldwide (Surfshark, 2026). A VPN is the most practical way to control what location websites see.
• You can see exactly what websites detect about your location right now using my location now.

Method 1: IP geolocation runs on every connection

This is the one that surprises people. Every time your browser loads a webpage, your device sends its public IP address to the server. That happens at the network level, before any content loads, before any script runs, before any cookie is set. The server sees your IP on every single request, the same way a phone call reveals your caller ID.

From that IP, the server queries a geolocation database. Companies like MaxMind, IP2Location, and ipinfo.io maintain massive datasets that map IP address ranges to physical locations. The lookup takes a few milliseconds and returns your country, region, city, timezone, ISP name, and approximate coordinates.

What makes it powerful and what limits it

The strength of IP geolocation is that it requires absolutely nothing from the user. No permission popup, no hardware requirement, no browser support needed. It works on every device, every browser, every operating system, on connections from a 2012 laptop the same way as on a 2026 smartphone.

The weakness is precision. Country-level accuracy sits above 99% for most providers. City-level accuracy is where things get shaky. We tested our own connection from a residential broadband line in a mid-sized city and got the correct city. We switched to mobile data on the same phone and the result jumped to a different city 60 km away because the carrier’s IP pool was registered there. That kind of discrepancy is normal, not a bug.

Method 2: the browser asks for your GPS coordinates

You have seen the popup: “This site wants to know your location. Allow or Block.” That is the browser Geolocation API, a W3C standard built into every modern browser since 2012. When you click Allow, the browser shares your coordinates directly with the website, and those coordinates come from your device’s GPS chip, Wi-Fi positioning, or a combination of both.

The accuracy difference with IP geolocation is enormous. GPS can pinpoint you within 2 to 5 meters outdoors. Even without GPS (on a laptop with no GPS chip), Wi-Fi positioning can get within 20 to 50 meters by cross-referencing nearby Wi-Fi access point locations from databases maintained by Google and Apple.

The catch: you have to say yes. If you click Block, the website gets nothing from this method. It falls back to IP geolocation, which means it still knows your country and approximate city, but not your street or building. Roughly 85% of users deny location permission when prompted on desktop browsers (source to verify). On mobile apps, acceptance rates are higher because people understand why a map or weather app needs their position.

When websites ask and when they don’t bother

Most websites never trigger the permission popup. They don’t need meter-level precision. A news site only needs your country to show local headlines. An e-commerce platform only needs your region to display the right currency and shipping options. IP geolocation handles all of that silently.

The sites that do ask are the ones where precise location changes the experience: maps, food delivery, ride-hailing, store finders, weather apps. If a site asks for your location and its core function has nothing to do with proximity, that should raise a question about why it needs that data.

Method 3: Wi-Fi and cell tower triangulation

This method sits between IP geolocation and GPS in terms of both precision and intrusiveness. Your device constantly scans for nearby Wi-Fi networks and cell towers. The signal strength and identifiers of those networks can be cross-referenced against databases of known access point locations to estimate your position.

Google built one of the largest Wi-Fi location databases in the world, partly through Street View cars scanning Wi-Fi networks as they drove, and partly through Android devices passively reporting nearby networks. Apple maintains a similar database from iPhones. When the browser Geolocation API is used on a device without GPS (a desktop or a laptop), this is often the fallback method, and it can be accurate to within 20 to 50 meters in urban areas with dense Wi-Fi coverage.

The practical implication: even without GPS, your location can be determined with reasonable accuracy through Wi-Fi signals alone. Turning off Wi-Fi scanning (not just disconnecting from networks, but disabling the scan function) is the only way to prevent this on Android. On iOS, the option is buried in Privacy settings under Location Services.

Five real scenarios where this affects you

Location detection is not abstract. Here are five situations where it directly impacts what you see, what you pay, or what you can access.

Streaming geo-restrictions

Netflix, Disney+, Amazon Prime Video, and every major streaming service use IP geolocation to determine which content library to show you. A subscriber in France sees a different catalog than one in the US, even on the same plan at the same price. The decision is made entirely based on your IP address. No GPS, no browser permission, just the IP attached to your connection. This is why VPN usage for streaming remains one of the most common reasons people subscribe to a VPN service.

Dynamic pricing

Some e-commerce platforms and booking sites adjust prices based on your detected location. Flight prices can vary depending on which country the search originates from. Hotel booking platforms have been documented showing different rates for the same room depending on the visitor’s IP location. Whether this qualifies as price discrimination depends on the jurisdiction, but the mechanism is simple: the website reads your IP, determines your country, and adjusts the display price accordingly.

Banking fraud alerts

Your bank checks your IP location on every login. If you usually log in from London and a session suddenly originates from a server in Nigeria, the system flags it as suspicious and may block the transaction or require additional verification. IP geolocation is one of the primary signals in real-time fraud detection, alongside device fingerprinting and behavioral analysis. This is one case where location detection works in your favor.

Search result localization

Google and other search engines use your IP location to customize results. Searching “restaurant near me” from Paris gives French restaurants, from Tokyo gives Japanese ones. Even queries that don’t include “near me” are influenced by your location: product availability, local news, event listings, business hours all get filtered through your detected position. You can test this by checking ipme.co and comparing the result with what Google thinks your location is.

Content and language defaults

Websites that serve multiple regions use IP geolocation to pick a default language and regional version. A visitor from Germany gets the German version, a visitor from Brazil gets Portuguese. This usually works well, but it creates a confusing experience for travelers, expats, and anyone on a VPN. If you have ever landed on a website in a language you don’t speak and couldn’t find the language switcher, IP geolocation is almost certainly the reason.

What you can and cannot control

The three detection methods have different levels of user control, and understanding those differences is what matters most.

IP geolocation: you cannot stop it, but you can change it. Your IP address is sent with every connection. There is no browser setting to hide it, no opt-out, no permission prompt. The only way to change the location it reveals is to route your traffic through a different exit point: a VPN, a proxy, or the Tor network. A VPN is the most practical option for daily use. Connect to a server in another country and every website sees that country as your location.

Browser Geolocation API: you have full control. Every browser asks before sharing GPS or Wi-Fi positioning data. You can deny the request, and the site receives nothing. You can revoke permission later in browser settings. You can disable the Geolocation API entirely. This is the one method where consent is real and enforceable.

Wi-Fi/cell tower triangulation: partial control. Disabling Wi-Fi scanning stops Wi-Fi-based positioning, but cell tower triangulation still works as long as your phone has a cellular signal. The only way to fully prevent it is airplane mode, which also disconnects you from the internet. In practice, this method is mostly relevant to apps with location permission, not to websites you visit in a browser.

Detection method	Permission needed	Precision	How to prevent it
IP geolocation	None	Country/city (5-50 km)	VPN, proxy, or Tor
Browser Geolocation API	Explicit consent	2-5 meters (GPS)	Click “Block” on the prompt
Wi-Fi triangulation	Varies by OS	20-50 meters	Disable Wi-Fi scanning in OS settings
Cell tower triangulation	None (carrier level)	100-300 meters	Airplane mode

Frequently asked questions

Can a website know my exact home address?

No. IP geolocation resolves to a city or neighborhood at best, never a street address. The browser Geolocation API can get within a few meters, but only if you click Allow on the permission prompt. No website can access your physical address without your active consent or a legal order served to your ISP.

Does incognito mode hide my location?

No. Incognito or private browsing prevents your browser from saving history and cookies. It does not change your IP address and does not block IP geolocation. Websites still see the same IP and the same location whether you use normal mode or incognito. For location privacy, you need a VPN, not incognito mode.

Why do I see ads for my city if I never shared my location?

Ad networks use IP geolocation by default. Every time an ad loads, the ad server reads your IP, determines your approximate city, and serves a geographically targeted ad. No browser permission is needed for this. It happens on every ad impression, on every website with ads, automatically.

Is IP geolocation legal?

In most jurisdictions, yes. IP addresses are considered personal data under GDPR in Europe, which means websites must have a legal basis to process them (usually “legitimate interest” for basic functionality like language detection). In the United States, there is no federal law restricting IP geolocation for commercial use. The key legal line is between passive detection (reading an IP) and active tracking (building a location history), with the latter facing stricter regulation.

Does a VPN completely hide my location?

A VPN hides your IP-based location by replacing your IP with the VPN server’s IP. Websites see the VPN server’s country and city instead of yours. It does not hide GPS-based location: if you grant browser permission or if an app accesses your device’s GPS, your real position is still visible regardless of the VPN. For complete location privacy, use a VPN and deny all browser location permission prompts.

Why does one website show my correct city but another shows a different one?

Different websites use different geolocation databases (MaxMind, IP2Location, ipinfo.io, DB-IP, etc.), and those databases do not always agree on city-level mapping. Each provider builds its data from different sources and updates on a different schedule. Country and region are usually consistent across providers. City is where discrepancies appear, especially if your ISP recently reassigned your IP block.