How does IP-based location differ from the browser Geolocation API?

The first runs silently and without permission, is dependable at country level and only approximate at city level. The second returns precise coordinates but raises a permission prompt for every visitor, which is why no analytics tool uses it for general reporting and only products that genuinely need an exact position rely on it.

Does geolocation data count as personal data?

Country and city in aggregated reports usually cannot be traced to an individual, but the IP address they were derived from is treated as personal data under most legal frameworks. The safe practice is therefore to mask or truncate the address before storage and retain only the country and city level.

Geolocation

Intermediate

Updated Jul 11, 2026 Shahin editorial 2 min read

PronunciationEN/ˌdʒiːoʊloʊˈkeɪʃən/

Geolocation is the determination of where a visitor is, done in analytics almost always by looking up their IP address in a location database rather than by asking the device.

Two entirely different mechanisms share this one name, and confusing them causes most of the misreadings. The first is the browser Geolocation API, which requires explicit user permission, returns coordinates accurate to tens of metres and serves mapping and delivery applications. The second is an IP address lookup, which asks no permission, shows the user no prompt and reaches city level at best. Analytics reports always come from the second mechanism, so what is shown is where the traffic leaves the network rather than where the person is sitting, and mobile operator gateways, corporate networks and VPNs each pull those two apart. The privacy layer sits here too: common practice is to truncate or mask the IP address before storage, keeping the derived country and city but not the address itself.

FAQ

Sources:MDN — Geolocation API