How a Website Can Guess Your City Without Asking

In this story 4 sections

Open a website for the first time and there is a good chance it already has a rough idea of where you are. Maybe it shows prices in your currency, a weather widget for your area or a list of stores nearby. You did not type your city. The site worked it out, usually without your browser asking for permission at all.

It starts with your IP address

Every connection to a website comes from an IP address, the number the internet uses to send replies back to you. Those numbers are not handed out at random. Blocks of addresses are allocated by five regional internet registries, covering North America, Europe and the Middle East, Asia-Pacific, Latin America and Africa, to internet providers and organisations, which then assign them to their customers.

Because addresses come in blocks tied to specific providers and regions, an address says something about where a connection probably comes from. Companies build geolocation databases that map ranges of addresses to countries, regions and cities, combining registry records, information from providers, network measurements and other data sources. A website looks up your address in one of these databases and gets a best guess.

Why the guess is often off

At the country level these databases are usually right. At the city level they are much shakier. Your address might be registered to your provider's office in a bigger city nearby, so the database puts you there. Mobile networks often route traffic through a regional gateway, which is why your phone can appear to be in a different city from the one you are standing in. A VPN goes further still: sites see the VPN server's address, so you appear wherever that server is.

The farm in the middle of America

Sometimes a database knows only the country an address belongs to. It still has to give a pair of coordinates, so it uses a default point. In 2016, journalist Kashmir Hill reported that a widely used database had placed hundreds of millions of US IP addresses it could not locate more precisely at a single default point near the geographic centre of the country, which happened to be a farm in Kansas. For years the people living there received visits and complaints from strangers convinced that a scammer or a stolen device was on their property. After the story ran, the company moved its default point to the middle of a nearby lake.

“

A location database never says I don't know. It gives you coordinates, and coordinates look like facts.

What you can do about it

If a site keeps getting your location wrong, there is usually a setting to choose your region by hand. If you would rather sites did not know your rough area at all, a VPN changes the address they see, with the trade-offs of trusting the VPN provider instead. And it is worth remembering the lesson of the Kansas farm: an IP address is a clue, not an identity, and a pin on a map is only as good as the guess behind it.

TA

Written by

Tamsin Ardley

Editor

11+ years experience

Tamsin came to Oddworldz after years of editing technology coverage for general readers. She writes on all three of the desk's beats, how things work online, AI oddities and digital life, and edits every piece for precision: what is known, what is guessed and what is simply a good story. Her favourite stories start with a small, strange observation and end with a clear explanation of the system behind it. Outside work she collects badly translated error messages.

Covers

• internet infrastructure
• technology explainers
• fact-checking
• digital culture