What is IP geolocation?

IP geolocation is the practice of working out roughly where in the world a device is, using nothing but the IP address its internet connection is using at that moment. It is how a website greets you in your own language before you have told it anything, how your bank flags a login from a country you have never visited, and how a streaming service decides which catalogue you are allowed to see. It is also how GeoTrack can tell you that the proposal you sent this morning was opened in Rotterdam.

The important thing to understand at the outset is what kind of answer it gives. IP geolocation is an estimate, not a measurement. It will usually put your recipient in the right city. It will never put them on the right street, and anyone claiming otherwise is describing something that does not exist.

How an IP address becomes a place on a map

An IP address contains no location information. There is nothing encoded in the digits that says "Rotterdam". What exists instead is a chain of public records and inference that geolocation providers assemble into a lookup table, and the quality of that table is the whole business.

It starts with the regional internet registries — RIPE NCC in Europe and the Middle East, ARIN in North America, APNIC in Asia-Pacific, LACNIC in Latin America, AFRINIC in Africa. These bodies allocate blocks of addresses to internet providers and publish who received what. That gives you the organisation and the country with a high degree of confidence, because it is a matter of public registration rather than guesswork.

Getting from country to city takes more work. Providers publish their own geographic assignments for parts of their network. Latency measurements from servers in known locations narrow things down further: if a connection responds in three milliseconds from Amsterdam and forty from Madrid, it is not in Spain. Some providers layer in corrections submitted by websites and users who noticed they were being placed in the wrong city. The resulting database is rebuilt continuously, because networks are reorganised constantly — an address block serving one city this month may serve another next month.

This is why the databases are commercial products rather than a public utility, and why the free ones are noticeably worse. Accuracy is maintained, not discovered once.

Why the answer is sometimes wrong

Four situations account for most of the errors, and it is worth knowing them so you can read your own data sensibly.

Mobile networks. A phone does not connect to the internet from where it is standing. Its traffic is routed through the carrier's gateway, which may be a single facility serving an entire region. Someone reading your email on a train outside Lille can plausibly appear in Paris. Mobile is the single largest source of city-level error, and it is not a flaw in the database — the gateway really is where the traffic emerges.

Corporate networks and VPNs. A large company routes staff traffic through central exits. An employee in a regional office may consistently appear at headquarters in another country. VPNs do this deliberately, and the location you get is the exit node, which is exactly what the user wanted.

Reassignment. Providers move address blocks between markets. A database that has not caught up will place a connection where that block used to serve.

Sparse coverage. Rural, satellite and some developing-market connections have fewer reference points to triangulate against, so the estimate falls back to a regional or national centroid. If a location looks suspiciously like the exact geographic middle of a country, that is usually what has happened.

Why no email tracker can use GPS

People often assume that because a phone knows precisely where it is, an email opened on that phone can report the same thing. It cannot, and the reasons are structural rather than a limitation any vendor could engineer around.

Most desktop and laptop computers have no GPS receiver at all. More decisively, GPS on a phone is guarded by the operating system and released only to an application the user has explicitly granted permission, in the moment, with a visible prompt. Email clients do not ask for that permission and would not be given it for rendering a message. The web standard that lets a browser share precise location, the W3C Geolocation API, requires JavaScript and an explicit user grant — and email clients do not execute JavaScript in messages, precisely so that this sort of thing cannot happen.

So every email tracking product on the market, ours included, works from the IP address. Any product claiming GPS-level precision from an email open is either mistaken about its own technology or hoping you will not ask.

What proxies do to the answer

There is a second complication specific to email, and it has grown considerably in the past few years.

When your recipient uses Gmail, Google does not let their device fetch the tracking pixel directly. Google's servers fetch it first, cache it, and serve it on. The IP address that reaches us therefore belongs to a Google data centre, and geolocating it tells you where a building full of servers is — frequently in a state or country your recipient has never been to. Apple Mail Privacy Protection goes further: it routes image requests through Apple's relay and pre-fetches them whether or not the recipient ever opened the message.

A tracker that reports these naively will show you confident, precise, entirely fictional locations. We would rather show you nothing than something false, so GeoTrack identifies proxy traffic and marks the event as a confirmed open without attaching a map to it. If the location matters and your recipient is on Gmail, include a link in your message: a click travels from the recipient's own connection, and that gives you a real location.

How accurate is it, in numbers

The commercial database we license resolves to roughly 99% accuracy at country level and around 75% at city level, where "city level" conventionally means within about 20 miles of the true position. [Confirm these figures against your provider's current published accuracy table before publishing, and consider naming the provider — it is a credibility signal your competitors mostly avoid giving.]

Those two numbers deserve a moment's thought, because they are more honest than they first appear. Country accuracy near 99% means that if we tell you an email was opened in Germany, it almost certainly was. City accuracy of 75% within 20 miles means that a city-level result is a strong indication rather than a certainty, and that one reading in four will be off — usually because of the mobile and corporate routing described above.

Read this way, the data is genuinely useful and also easy to misuse. "Opened from somewhere around Munich" supports a decision about when to call and what language to write in. It does not support an accusation about where someone was on Tuesday afternoon.

IP addresses and privacy law

An IP address is not an anonymous number in European law. The Court of Justice of the European Union held in Breyer (C-582/14, 2016) that a dynamic IP address constitutes personal data in the hands of anyone with a lawful means of linking it to an individual. Under the GDPR that means IP-based geolocation is processing of personal data and needs a legal basis, a purpose, and a retention limit.

This became sharper for email specifically in 2026. France's CNIL published its recommendation on tracking pixels on 14 April 2026, classifying them as trackers requiring prior consent for most marketing purposes, with a transitional window for existing contact lists that closed on 14 July 2026. If you send commercial email into France, informing your recipients and offering an opt-out is now an obligation rather than a courtesy.

Our part of that is set out in our Data Processing Agreement and privacy policy: we store the location derived from an open, never the contents of your emails, and we provide the opt-out mechanism the recommendation requires.

What you actually see in GeoTrack

For each tracked message, when the open is not proxied: the country and city we resolve from the IP, a map pin at that estimate, the local time where your recipient appears to be, the device and email client used, and whether any links were followed. For proxied opens, the same timeline minus the location, clearly labelled rather than quietly filled in with a data centre.

You can try all of it on the free plan before deciding whether the full geolocation features are worth paying for.

Common questions

Can IP geolocation identify a person? No. It resolves a network connection to an approximate area. Connecting that to a named individual requires records held by the internet provider, which are released to law enforcement under legal process and to nobody else.

Can it give me a street address? No. Any service advertising this is selling an illusion, and the confident precision is the tell.

Does a VPN defeat it? Yes, entirely and by design. You will get the location of the VPN exit node.

Why does the same recipient appear in different cities? Usually because they read your messages on a phone sometimes and a desktop at other times, and the two connections leave the network in different places. It is one of the more reliable signals that someone is reading you on the move.

You may also be interested in:
What is email tracking?
The benefits of email tracking
Frequently asked questions