Location API Explained: Geolocation, IP Lookup, and Privacy

A location API lets software answer a deceptively simple question: where is this user? The answer can come from a browser asking the device for GPS coordinates, from a server matching an IP address to a city, or from a mix of both. Each method has different accuracy, cost, and privacy trade-offs, and picking the wrong one is a common source of bugs and user complaints.

This guide explains the two main families of location APIs, shows practical code and request examples, compares accuracy and privacy, and covers how to verify what your own connection actually reveals.

What a location API actually does

Location API Explained: Geolocation, IP Lookup & Privacy - What a location API actually does.

A location API returns structured location data to an application. That data usually falls into two categories:

• Device-level coordinates — latitude and longitude obtained from GPS, Wi-Fi positioning, or cell towers, with an accuracy radius in meters.
• Network-level estimates — country, region, city, postal code, timezone, and ISP derived from an IP address, with accuracy measured in kilometers or larger.

Some platforms combine both. A weather app might use IP geolocation for a default city, then request precise device coordinates only when the user taps "use my location." That layered approach keeps the first screen fast and avoids an unnecessary permission prompt.

Browser geolocation: the Geolocation API

Location API Explained: Geolocation, IP Lookup & Privacy - Browser geolocation: the Geolocation API.

The Geolocation API is a web standard exposed through navigator.geolocation. It is widely available across modern browsers and requires a secure context (HTTPS).

Core methods

• getCurrentPosition() — retrieves the device's current location once.
• watchPosition() — registers a handler that fires whenever the position changes.
• clearWatch() — stops a previously registered watch.

Both retrieval methods accept a success callback, an optional error callback, and an options object.

A minimal example

navigator.geolocation.getCurrentPosition(
  (position) => {
    const { latitude, longitude, accuracy } = position.coords;
    console.log(latitude, longitude, `±${accuracy} m`);
  },
  (error) => {
    console.error(error.code, error.message);
  },
  { enableHighAccuracy: true, timeout: 10000, maximumAge: 0 }
);

What the options mean

Option	Effect
enableHighAccuracy	Requests the most precise source available, often GPS. Slower and more battery-intensive.
timeout	Maximum time to wait for a result before the error callback fires.
maximumAge	Accepts a cached position no older than the given milliseconds.

Permission and security rules

The user must explicitly grant permission before coordinates are returned. Browsers show a prompt the first time either method is called, and the permission lifetime varies by browser — it can be session-based, time-based, or persistent.

Two additional constraints matter for developers:

• The feature is only available in secure contexts, so HTTPS is mandatory.
• Access can be restricted with the geolocation Permissions Policy directive. The default allowlist is self, which limits access to same-origin nested frames. Third-party embeds need an explicit Permissions-Policy header plus an allow="geolocation" attribute on the iframe.

You can check the current permission state through the Permissions API before prompting, which avoids a confusing prompt for users who already denied access.

Known limitations

Wi-Fi-based positioning is often provided by Google, so the vanilla Geolocation API may be unavailable or degraded in some regions, including China, where local providers are commonly used instead. Desktop devices without GPS often fall back to Wi-Fi or IP-based estimates, which can be far less precise than the accuracy value suggests.

IP geolocation APIs: location without a permission prompt

Location API Explained: Geolocation, IP Lookup & Privacy - IP geolocation APIs: location without a permission prompt.

IP geolocation APIs work on the server side. You send an IP address and receive a JSON, XML, or CSV response describing the network's registered location. No user prompt is involved, which makes these APIs useful for analytics, fraud checks, content localization, and default settings.

A typical request looks like this:

GET https://ip-api.com/json/24.48.0.1

A typical response includes fields such as:

{
  "query": "24.48.0.1",
  "status": "success",
  "country": "Canada",
  "countryCode": "CA",
  "regionName": "Quebec",
  "city": "Montreal",
  "lat": 45.5019,
  "lon": -73.5674,
  "timezone": "America/Toronto",
  "isp": "Example Telecom",
  "org": "Example Org",
  "as": "AS12345",
  "proxy": false,
  "hosting": false
}

Fields like proxy, hosting, and mobile are especially useful for abuse detection, because datacenter and VPN ranges behave differently from residential connections. IP-API is one long-running free option; its free endpoint is limited to 45 HTTP requests per minute per IP address and is not licensed for commercial use, so production systems typically need a paid tier.

Accuracy expectations

IP geolocation is not a precise positioning system. Realistic expectations:

• Country — usually reliable.
• Region and city — often correct for residential ISPs, frequently wrong for mobile carriers and corporate networks.
• Street address — not available from IP data, despite what some marketing pages imply.

Mobile traffic is the biggest source of error, because carrier-grade NAT can route thousands of subscribers through a single IP registered to a distant gateway city.

Geolocation API vs IP geolocation API

Location API Explained: Geolocation, IP Lookup & Privacy - Geolocation API vs IP geolocation API.

Dimension	Browser Geolocation API	IP geolocation API
Data source	GPS, Wi-Fi, cell towers	IP address registration and routing
Typical accuracy	Meters	City-level at best, often region-level
User consent	Required prompt	None
Runs on	Client	Server
Works without JS	No	Yes
Best for	Maps, navigation, check-ins	Localization, fraud checks, analytics

A practical rule: use the browser API when the user benefit depends on precise position, and use IP geolocation when you need a reasonable default without interrupting anyone.

Privacy considerations you should not skip

Location data is among the most sensitive categories of personal data. A few principles apply regardless of which API you choose:

1. Ask only when needed. Requesting precise coordinates on page load trains users to deny prompts permanently.
2. Explain the benefit. A short line of context before the prompt increases grant rates and reduces support tickets.
3. Minimize retention. Store coordinates at the lowest precision that still serves the feature, and delete them when the purpose ends.
4. Respect denial. Always provide a manual fallback such as a city selector.
5. Treat IP data as personal data. Under many privacy regimes, an IP address tied to a user is identifiable information.

How to verify what your connection reveals

If you use a VPN, proxy, or corporate gateway, it is worth confirming what location signals your traffic actually exposes. Two things commonly leak:

• WebRTC can expose real IP addresses even when a VPN is active, which undermines any IP-based location masking.
• DNS resolution can reveal the true network path if queries bypass the tunnel.

BrowserScan provides free, browser-based diagnostics for exactly this scenario, including WebRTC and DNS leak tests, an IP address lookup with geolocation and proxy detection, and browser fingerprint analysis. Running those checks after configuring a tunnel shows whether the location data your applications receive matches what you expect. For teams managing tunnels at scale, the workflow in VPN automation: scripts, cloud setups and leak tests covers how to keep verification continuous rather than one-off.

If your work involves spatial data more broadly — combining location feeds with business or operational datasets — the concepts in location intelligence explain how location APIs fit into larger analytics pipelines. And if you are comparing IP data providers, this IPWHOIS.io review breaks down endpoints, rate limits, and pricing tiers for one popular free option.

Choosing the right approach

Use this short decision path:

1. Does the feature fail without precise coordinates? If yes, use the browser Geolocation API with a clear permission prompt.
2. Do you need a sensible default or server-side logic? Use an IP geolocation API.
3. Do you need both? Start with IP geolocation, then upgrade to device coordinates on explicit user action.
4. Is fraud or abuse detection the goal? Combine IP geolocation with proxy, hosting, and ASN signals rather than relying on city alone.
5. Is privacy a hard requirement? Prefer coarse data, short retention, and transparent disclosure.

Related reading

• IP-Lookup.net Tutorial: Check Any IP Address in Seconds - A practical IP-Lookup.net tutorial: run an IP lookup, read geolocation, ISP, and proxy data, verify what your VPN hides, and avoid common mistakes.
• What Is PrivacyTools.io? History, Tools & How to Verify - PrivacyTools.io is a long-running privacy tool directory with a complex history. Learn what it offers today, its split from Privacy Guides, and how to test your setup.

Sources and further reading

• IP Address Location API - IP Location & Free IP Lookup - IP Address Lookup and Geolocation API from ipapi. Find city, country, currency, language, timezone, org. Fast & Secure - JSON / CSV / XML

Frequently asked questions

Is the Geolocation API free to use?

Yes. The browser Geolocation API is a web standard with no licensing cost. IP geolocation services vary: some offer free tiers with rate limits, while production or commercial use usually requires a paid plan.

Why does IP geolocation show the wrong city?

IP addresses are registered to network operators, not to physical devices. Mobile carriers, VPNs, and corporate networks often route traffic through gateways in different cities, so the registered location can be far from the user.

Can a website get my location without asking?

Not through the Geolocation API — browsers require explicit permission. However, a server can estimate an approximate location from your IP address without any prompt, which is why IP-based location is considered less private.

Does a VPN change what a location API returns?

It changes the IP address your requests originate from, so IP geolocation will typically report the VPN server's location. It does not change GPS coordinates, and it does not help if WebRTC or DNS leaks expose your real IP.

How accurate is enableHighAccuracy?

It requests the most precise source available, which is often GPS and can be accurate to a few meters outdoors. Indoors or on desktops without GPS, the browser may fall back to Wi-Fi positioning with much lower precision, even when the flag is set.

What is reverse geocoding?

Reverse geocoding converts coordinates into a human-readable address or place name. It is a separate service from the Geolocation API itself, usually provided by mapping or geocoding vendors.

Conclusion

Location APIs split into two clearly different tools: the browser Geolocation API for precise, consent-based coordinates, and IP geolocation APIs for server-side estimates that need no permission. Understanding the accuracy ceiling of each prevents the most common mistakes — expecting street-level precision from an IP address, or prompting users for GPS when a country-level default would do.

Whichever you implement, verify the underlying network path. Leaks through WebRTC or DNS can quietly contradict the location data your application believes it has, and a quick round of browser-based testing is the fastest way to catch that before your users do.