How accurate is free IP geolocation?

Every IP geolocation answer is a claim about a network, and the honest question is not "is it right" but "right at what level, and how would anyone know". This guide gives the numbers Spaw measures every week, explains what they do and do not mean, and says which fields to build a decision on.

Where a location comes from

Two kinds of source answer the country, region, city, latitude and longitude fields.

The first is a database: DB-IP Lite, a monthly release that maps every prefix to a place, built by the publisher from routing data, registry records, measurements and whatever else its method uses. It is the answer for most addresses, and location_source reads database when it is.

The second is the operator's own declaration. Some networks publish where their prefixes are: a geofeed in the format RFC 8805 fixed in 2020, which the registries let an operator link from its registration record; Apple's list of iCloud Private Relay egress addresses with the city each stands for; the server lists the VPN providers publish; the RFC 8805 files DigitalOcean, Linode and Vultr publish for their clouds. Where one of these covers an address, its declaration wins over the database and location_source reads operator. Once a week the service discovers every geofeed the five registries point at and compiles them into one feed.

What is measured, and how

Every Sunday a measurement samples addresses from the operator-declared ranges and asks the database the same question: does the database put this address in the country the operator declared, and in the city? The result is published on the status page and on the product page, dated, and it grades the location_confidence field for the following week.

It is important to be precise about what that measures. It is agreement between the database and an operator's statement, not agreement with ground truth. An operator's file says where a prefix is deployed, as the operator understands it; it is the best public evidence there is, and it is still a statement. The sample is also skewed by construction: only networks that publish declarations are in it, which means clouds, relay egress and VPN exits are over-represented and ordinary consumer ISPs, most of which publish nothing, are under-represented. Where a country's sample is dominated by CDN and relay ranges whose declared city the database does not know, the grade is harsher than a home connection in that country deserves. The measurement says so rather than hiding it.

The numbers

Measured on 5 September 2026, over the geofeed ranges:

• Country agreement: 84.6 %.
• City agreement: 28.6 %, on an exact city-name match, which undercounts — "Frankfurt am Main" and "Frankfurt" are one city and count as a miss.
• Per-country city agreement, for the countries with enough compared samples: United States 69.9 %, United Kingdom 65.8 %, France 61.4 %, Netherlands 46.6 %, Germany 8.4 %, Japan 9.5 %. The current figure for every measured country is on its country page.

The gap between the first two lines is the whole story of free geolocation. Country is the level that holds. City is approximate everywhere, sometimes to the point of being wrong more often than right, and the German and Japanese figures are the reason the product page says city-level precision from free data should never carry a compliance or identity decision on its own.

How location_confidence reads it

location_confidence turns the measurement into one word per answer. An operator-declared location is high, because the network said so. A database-located address is graded by its country's measured city agreement: 75 % and above is high, 50 % and above medium, anything below low. A country with fewer than 20 compared samples, or a deployment where the measurement has not run yet, answers null rather than a guess.

One rule comes before both sources. When is_anycast, is_mobile or is_satellite is true, the grade is low whoever placed the address. An anycast range such as 1.1.1.1 is announced from hundreds of sites, so any city given for it is one instance among many. A mobile carrier puts its subscribers behind carrier-grade NAT at a gateway, and a satellite operator lands them at a ground station; an operator's geofeed for such a range truthfully names the gateway's city, and the people behind it can be hundreds of kilometres away.

Two more rules protect the coordinates. When an operator's declaration disagrees with the database on the country or the city, region, latitude and longitude answer null instead of a point in the wrong place — a coordinate for the wrong city is worse than none. And where is_anycast, is_datacenter, is_relay or is_vpn is true, the place in the answer is the operator's infrastructure, not anyone's home; the consistency endpoint withholds its country comparisons for exactly those addresses.

Time zones, and the border rule

timezone is settled first by a curated map: a country that keeps one clock, or a region known to lie in one zone, answers directly and timezone_source reads country or region. Split countries and regions — the United States, Canada, Australia, Brazil, Russia, Indonesia — used to answer null. Since September 2026 the nearest listed populated place settles them, from the GeoNames list of places with over 15,000 inhabitants, and timezone_source reads nearest_city.

The rule that keeps that honest is the border: the nearest place is searched inside the located country only, and within 250 km of the coordinates. A point in El Paso is nearer Ciudad Juárez than the centre of El Paso, and the answer must still be America/Denver, not Mexico's zone; an address on an island far from any listed place answers null rather than the nearest mainland zone.

What to build on

• Policy by country, defaults by city. Consent banners, currency and language belong on country, is_eu and is_eea. City is good enough to pre-fill a form and not good enough to refuse anything.
• Read location_confidence before city. A low grade is the measurement telling you the city is a coin toss for that country this week.
• Prefer the operator's word. location_source: operator means a network published the place itself; treat it as the best answer available, and remember that for a VPN exit, a relay or a mobile gateway it locates the exit, not the person.
• Never locate a person. An address belongs to a network. The most a free database can honestly say is which country a network operator serves, and the measurement above is what that claim rests on.

The IP intelligence guide documents every location field, and the status page carries the current week's measurement with its date.