How they know where you’re from: Secrets of digital location detection

Today’s online services have numerous motivations to obtain your location data. Companies use your precise location to deliver hyper-targeted advertising, such as showing you ads for a specific brand when you're near one of their stores. Detailed geographic insights are also highly valuable and can be sold to other businesses for significant profit. Additionally, companies may require your location to comply with various local laws and regulatory frameworks across different countries.

While these are all valid reasons for companies to collect your location data, that doesn’t necessarily mean it benefits you as a user. Often, you may want the flexibility to change the location that companies perceive to be in—whether to access a website that restricts users from certain countries, use a streaming service available only in specific regions, or for hundreds of other reasons. This is why many people turn to VPNs.

However, if you assume that simply turning on a VPN is enough in all cases, you might be in for a surprise. Companies today employ a variety of advanced methods to determine your real location. In this article, we’ll explore the most common modern techniques used to track your location and what you, as a user, can do to counter them.

IP Address

Determining a user’s location based on their IP address is the most basic yet still the most commonly used method today. Every device connected to the internet must have an IP address—essentially a digital postal code that helps identify the origin and destination of every connection. Much like a postal code, your IP address alone reveals a significant amount of information about your current location.

Your device's IP address is assigned by your internet service provider (ISP), which maintains different pools of IP addresses for users in different regions. Using publicly available databases of IP address allocations, anyone can determine which ISP an IP address belongs to and get a rough location, typically down to the city level. This is how many websites and apps detect the country and/or state a user is accessing them from.

With VPN services like Vector Link, you can easily change your IP address to one from a different country. However, as you will discover later, this may not always be enough to fully conceal your location.

GPS

Smartphones, laptops, and other mobile devices come equipped with GPS, which provides highly accurate location data. When you grant an app or website permission, it can access this data to determine your exact position, down to the meter level. This method is far more precise than relying on an IP address; however, it requires the user to explicitly grant location access.

If an app requires GPS permissions to function and you want to spoof your location, consider using a rooted Android device. Root access allows you to “hack” system-level settings, including GPS data, allowing you to fake your location as needed.

Wi-Fi Positioning

Modern phones also have a Wi-Fi positioning system that uses nearby Wi-Fi networks to determine a device’s location, often with GPS-level accuracy, especially in urban areas. When your device scans for available Wi-Fi networks, it collects data on nearby routers, including their signal strengths and unique identifiers (usually MAC addresses). Companies like Google and Apple maintain extensive databases built from telemetry data collected from their devices, allowing them to map your location solely based on the Wi-Fi networks detected in your area. Unlike GPS, this works the best indoors.

On modern operating systems, this kind of positioning typically requires the same level of permission as GPS, giving you the option to deny access in most cases.

Cellular Network

Mobile apps can also determine your country by accessing information from the cellular network you are connected to. Every cellular network has unique identifiers, including a Mobile Country Code (MCC) and Mobile Network Code (MNC), which indicate the country and carrier. Apps can read this information to infer your general location, even if GPS and Wi-Fi tracking are completely disabled. To make matters worse, Android does not require any special permission for apps to access this data, meaning users have no simple way to prevent apps from retrieving it.

A notable example is TikTok. The Chinese government bans domestic users from accessing the global version of the app, allowing them only to use Douyin, the local variant. TikTok enforces this restriction by checking both the user's IP address and SIM country code. Even if you use a VPN to obtain a non-Chinese IP address, having a Chinese SIM card installed will still prevent access to the international version of TikTok. The most common workaround is simply removing the SIM card, preventing the app from detecting the country through this method.

Language and Regional Settings

Your device's language settings, operating system locale, and timezone can all provide clues about your location. This information is easily accessible to both websites and apps without requiring any special permissions. Since these settings align with a user's actual region most of the time, companies use them as additional signals to infer location. For regular users, the only way to prevent this type of tracking is to manually change these settings to a different location.

Account Details and Preferences

Then in many cases, you just voluntarily provide location information—whether for setting the correct language, receiving personalized content, entering a shipping address, or even uploading photos with EXIF metadata that contains location data. These details can and will be used by companies for tracking purposes. So, if you’re serious about privacy, be mindful of the information you share. Always review your settings, strip location metadata from photos before uploading, and consider the potential implications of each action you take online.