IP geolocation is the practice of inferring where a device physically sits from the internet protocol address attached to its traffic. Nothing in that address states a place. An address is a routing label issued by a network operator, and the location attributed to it is an estimate produced by a third party that has studied which operator holds which block and where its customers tend to live. The estimate comes back as a country, a region, a city, a postal code or a pair of coordinates, and advertising systems treat it as fact because nothing else works at the same scale for the same price.

It exists because every other method requires permission. Satellite positioning and the browser Geolocation API both need a user to agree. An address arrives with every request, unasked, because without one the packets cannot come back. That asymmetry turned a guess into the default input for geographic targeting, jurisdiction detection, fraud screening and frequency management.

How an address becomes a place

Commercial providers sell the mapping. Digital Element operates NetAcuity, MaxMind sells GeoIP2, and IP2Location, IPinfo and DB-IP compete alongside them, each shipping a database refreshed weekly or daily. The inputs behind it are indirect. Regional internet registries publish allocation records naming which organisation holds which block. Reverse domain lookups often encode a city or exchange in the hostname an operator assigns to a customer line. Latency measurements from probes at known locations bound the distance a packet could have travelled. Service providers supply customer distribution tables directly, and consumer sites that ask for a postal code pass the pairing back. On that base vendors sell refinements, among them alternative geographic boundaries replacing postal ones.

Because the inputs are inferential, every provider must decide what to return when confidence collapses. The usual answer is a centroid, the middle of a country or a state, and that convention produced the field's best-documented failure.

Where the estimate enters the auction

In OpenRTB the result travels in the Geo object, section 3.2.19 of the specification. Subordinate to a Device object it describes where the device is; subordinate to a User object, a home base rather than a current position. Its fields run from lat and lon through country as an ISO-3166-1 alpha-3 code, region as an ISO-3166-2 code, metro, city as a United Nations trade and transport location code and zip, to utcoffset in minutes from coordinated universal time.

Two fields do the disambiguation work. The type attribute records how the location was determined, with 1 for satellite or device location services, 2 for an address lookup and 3 for a user-supplied value such as a registration form. The ipservice attribute names the vendor behind the lookup, referenced against the IP location services list in AdCOM 1.0, and applies only when type is 2. A buyer reading a populated request therefore sees which database produced the estimate. Google's Authorized Buyers documentation states that the company sources device locations only from address lookups, never from satellite signals, and never sends either field.

Resolution depends on how much of the address survives. A standard IPv4 address carries four numeric groups, and withholding the last one collapses a specific host into a /24 block of 256 addresses. AdSense truncated addresses that way by default until Google launched a publisher control restoring the fourth octet on 1 June 2026, sending full addresses to three Google demand channels. The control ships disabled, and the octet it restores underpins firmographic business-to-business targeting, where an impression resolves to the company owning the range rather than to a person.

Origin and evolution

The technique reached public attention through litigation. LICRA and the Union of French Jewish Students sued Yahoo in Paris in April 2000 over Nazi memorabilia auctions, and the company argued that no technical means existed to exclude French users. Three court-appointed experts, Vinton Cerf, Ben Laurie and François Wallon, reported on 6 November 2000 that roughly 70 per cent of French users could be identified from their addresses, rising towards 90 per cent if ambiguous cases were asked to declare a nationality. Cerf filed a separate note objecting that calling address-based location highly reliable would mislead. The order followed on 20 November 2000. MaxMind was founded in 2002, joining Digital Envoy and Quova.

Supply-side economics have worked against precision ever since. The central pool of IPv4 addresses ran out on 3 February 2011, and carrier-grade translation, formalised when a shared address block was reserved in 2012, placed growing numbers of households behind single public addresses. Escrow.com reported large-block prices at 24.67 dollars in mid-2026, and scarcity rewards operators who put more subscribers behind fewer addresses, diluting the signal every downstream system reads.

Why the estimate carries money

Four functions depend on it. Geographic targeting is the obvious one, and the grid tightens: Google Ad Manager added postal code targeting for Spain and Italy on 16 June 2025, joining eight markets already supported.

Jurisdiction detection is the second and the more consequential. Whether a request falls under European consent law is decided before the auction, almost always from the address, and the answer decides whether the impression can sell as personalised inventory.

Invalid traffic detection is the third: verification systems match addresses against known data centre ranges and residential proxy networks, work that degrades when the host portion is absent. Household identity is the fourth and the most contested. Google moved there on 18 December 2024, announcing policy changes permitting address-based connected television targeting from 16 February 2025, then accepted addresses as a Customer Match input on 28 May 2026, with European markets excluded.

Where it fails

Measured accuracy is poor and the published figures are converging. Research commissioned by the Coalition for Innovative Media Measurement and Go Addressable, run by Truthset across nearly a billion records and published on 5 November 2025, found address-to-postal linkages accurate 13 per cent of the time and address-to-email 16 per cent, with the six providers tested agreeing with one another 6.4 per cent of the time. Compounded through a campaign, the study traced one dollar of media spend down to three cents reaching the intended audience.

FreeWheel used the same dataset in February 2026 to argue that address-based targeting can miss 87 per cent of households, while disclosing that addresses drive 17 per cent of audience targeting on its own platform. Adstra and InterMedia Advertising reported on 15 July 2026 that 23 per cent of residential addresses reached the intended geographic target, alongside a Truthset estimate of 7.4 billion dollars wasted against a 38.0 billion dollar United States connected television total. Both findings came from companies selling an alternative.

Independent measurement is older. A study presented at the Internet Measurement Conference in 2017 tested four databases against known router locations, finding country-level accuracy of 89.4 per cent for NetAcuity against 77.5 to 78.6 per cent for the free MaxMind and IP2Location files, and city-level accuracy around 73 per cent at best.

Evasion is deliberate as well as incidental. Virtual private networks relocate a user wholesale, and adoption spikes on regulatory triggers: Proton VPN recorded a signup surge above 1,400 per cent in Britain after the Online Safety Act's age verification duties took effect on 25 July 2025. Concentration compounds it, and a Stanford analysis covered in August 2026 found that 5 per cent of addresses send 55 per cent of all web requests.

The centroid convention carries a documented human cost. MaxMind assigned a default coordinate near the geographic centre of the contiguous United States that resolved to a farmhouse in Potwin, Kansas, leaving roughly 600 million addresses pointing at one property. Its occupants reported years of police visits before reporting broke in April 2016. They sued that August, the default was moved to the middle of a reservoir, and the case settled in September 2017.

Not the same as

The W3C Geolocation API is the permission-gated browser channel, returning coordinates measured against a 95 per cent confidence radius. Chrome on Android added an approximate option at neighbourhood level. Precision is far better than address inference, availability far lower.

Geotargeting is the campaign setting that consumes the estimate. Geo-blocking is access control built on the same lookup, accepted as adequate by the Court of Justice of the European Union in the Anne Frank Fund copyright disputeunder a state-of-the-art standard rather than an absolute one. Address-based identity resolution treats the address as a household key rather than a map reference, and the 13 per cent figure belongs to that use, not to country-level geography, which remains far more reliable.

Recent developments

Browser-level masking has retreated. Chrome's IP Protection, detailed in February 2025 as a two-hop proxy for Incognito traffic, was retired with most of the Privacy Sandbox on 17 October 2025. Legal pressure moved the other way. A federal judge granted final approval on 26 March 2026 to the Google real-time bidding settlement, requiring a control that strips addresses and identifiers from bid requests when a user activates it. Retention is policed too: Spain's data protection authority fined Yoti 950,000 euros in March 2026 partly over holding address-derived location for five years after its purpose ended.

The largest change is European. Google told AdSense publishers on 17 June 2026 that it would begin using addresses for measurement and personalisation across the EEA, the United Kingdom and Switzerland on or shortly after 3 August 2026, citing on-device processing, trusted execution environments and secure multi-party computation. Advertiser-side controls remain weaker than that confidence implies: a Madrid agency showed in March 2026 that Google Ads exclusion lists can be bypassed by separating the address that harvests a click identifier from the one spending it.

Timeline

  • 5 April 2000: LICRA sends its cease and desist letter to Yahoo
  • 6 November 2000: Court-appointed experts report that roughly 70 per cent of French users are identifiable from their addresses
  • 20 November 2000: The Paris court orders Yahoo to filter French access
  • 2002: MaxMind is founded
  • 3 February 2011: The central IPv4 address pool is exhausted
  • 2012: A shared address block is reserved for carrier-grade translation
  • April 2016: Reporting reveals 600 million addresses defaulting to a farmhouse in Potwin, Kansas
  • August 2016: The Potwin residents sue MaxMind
  • 2017: An Internet Measurement Conference study puts NetAcuity country-level accuracy at 89.4 per cent
  • September 2017: The MaxMind case is resolved through alternative dispute resolution
  • 4 September 2024: Digital Element launches an alternate area database for Australia
  • 18 December 2024: Google announces policy changes permitting address-based connected television targeting
  • 16 February 2025: Those policy changes take effect
  • 16 June 2025: Google Ad Manager adds postal code targeting for Spain and Italy
  • 25 July 2025: United Kingdom age verification duties trigger a virtual private network signup surge
  • 17 October 2025: Chrome retires IP Protection with most of the Privacy Sandbox
  • 5 November 2025: CIMM and Go Addressable publish 13 per cent address-to-postal accuracy
  • February 2026: FreeWheel publishes its 87 per cent household miss analysis
  • March 2026: Spain's data protection authority fines Yoti 950,000 euros
  • 26 March 2026: A United States judge approves the Google real-time bidding settlement
  • 28 May 2026: Google accepts addresses as a Customer Match input, excluding European markets
  • 1 June 2026: AdSense publishers gain a control restoring the fourth octet in bid requests
  • 15 July 2026: Adstra and InterMedia report 23 per cent geographic accuracy
  • 3 August 2026: Google begins using addresses for measurement and personalisation in the EEA, the UK and Switzerland
  • August 2026: A Stanford analysis finds 5 per cent of addresses sending 55 per cent of web requests

Summary

Who. Database vendors including Digital Element, MaxMind, IP2Location and IPinfo produce the mappings. Exchanges, demand-side platforms, verification vendors and identity companies consume them, and network operators, regulators and browser makers shape how much of the underlying address survives.

What. The inference of a physical location from an internet protocol address, returned as a country, region, city, postal code or coordinate pair, and carried through programmatic trading in the OpenRTB Geo object.

When. Commercialised around 2000, validated in court that November, standardised into bidding protocols through the 2010s, and pushed back into mainstream advertising use by platform policy changes running from December 2024 to August 2026.

Where. Before the auction, where jurisdiction is classified, and inside the bid request, where the country, region, metro, city and zip fields carry the estimate alongside the type and ipservice attributes that describe how it was produced.

Why. It is the only location signal available on every request without consent, which is why it still decides geographic eligibility, regulatory treatment and fraud screening despite household-level accuracy measured at 13 to 23 per cent.