Why does Google show local search results even when you never asked for them? How does an online store already know which country you're connecting from before you've even entered any information? The answer lies in Location Tracking. Modern websites combine multiple location-detection techniques—not just Browser Geolocation—to pinpoint where you are, often with far greater accuracy than most people realize.
Everyday Examples of Location Tracking
Websites rely on several location-detection techniques—some highly accurate, others more approximate—to figure out where you're connecting from. Here are a few everyday examples of how Location Tracking affects your online experience:
- Streaming services: Platforms like Netflix offer different libraries of movies and TV shows depending on your country because of regional licensing agreements.
- Online banking: If you sign in to your bank account from an unusual location—such as another country or continent—many banks will trigger additional identity verification as a security measure.
- Online stores: Most e-commerce sites automatically display prices in your local currency, switch to the appropriate language, and may even show different products or promotions based on your location.
- Google Search and Maps: Google's services tailor search results to where you are. Search for "bakery," for example, and you'll typically see nearby bakeries rather than random results from elsewhere.
- Weather and local news: Weather services and news websites often detect your location automatically, showing local forecasts and regional headlines without requiring you to select your city manually.
How Does Website Location Tracking Work?
Location Tracking can be achieved in several ways, depending on the device, operating system, and browser. Some methods provide highly accurate coordinates, while others can only estimate a user's location. In the following sections, we'll explore the most common techniques websites use to determine your location.
IP Address Geolocation
IP geolocation is the most widely used method of estimating a user's location because it works automatically every time you visit a website. Unlike Browser Geolocation, it doesn't require your permission or any action on your part.
Whenever you open a website, your computer or smartphone sends its public IP address to the web server. This IP address doesn't belong directly to you—it is assigned by your Internet Service Provider (ISP).
ISPs are allocated IP address ranges that are associated with specific countries and regions. Companies such as MaxMind and IP2Location maintain massive IP geolocation databases that map these address ranges to real-world locations. A website simply looks up your IP address in one of these databases and receives an estimated location, typically including the country, city, and sometimes even the region.
With IP geolocation, the detected country is almost always accurate. City-level accuracy, however, is far less reliable—especially when you're connected through a mobile data network rather than a fixed broadband connection. In those cases, your IP address may appear to originate from a different city, or even a neighboring region, because of how mobile carriers route internet traffic.
Browser Geolocation (GPS and Network-Based Positioning)
When a website displays the familiar "Allow this site to access your location?" prompt, it's using the browser's Geolocation API. Every modern browser supports this API, but it can only provide your location after you explicitly grant permission.
Unlike IP geolocation, Browser Geolocation can determine your location with much greater accuracy because it relies on the best location sources available on your device, including:
- GPS, on smartphones and tablets equipped with a GPS receiver.
- Nearby Wi-Fi networks. Operating systems can use databases maintained by companies such as Google and Apple to estimate a device's location based on nearby Wi-Fi access points. You don't even have to be connected to a Wi-Fi network—simply detecting nearby access points is often enough to calculate a highly accurate location.
- Cell towers, which help estimate your position when GPS isn't available or the signal is weak.
The key difference is that this method requires your explicit permission. A website cannot access your precise location through the Browser Geolocation API unless you click Allow in your browser's permission prompt. If you decline, the site won't receive your precise coordinates and will generally have to rely on IP geolocation, which provides only an approximate location.
Browser and Device Settings
Beyond Browser Geolocation, websites can also rely on a variety of indirect signals to help narrow down your location. None of these signals is accurate enough on its own to pinpoint your location, but when combined, they can significantly improve Location Tracking.
For example:
- Time zone: A website can read your system's time zone automatically—no permission required. If your IP address points to Germany but your device is set to the Greece time zone, that inconsistency may be treated as an additional signal.
- Browser language: Your browser's preferred language (such as
en-USorel-GR) can provide another clue about the country or region you're likely in, and is often used to deliver localized content. - Operating system regional settings: In some cases, websites can infer your device's regional preferences—such as locale settings used for displaying currencies, dates, and number formats—which provide yet another geographic hint.
None of these signals reveals your precise location by itself. However, when they're combined with information such as your IP address or Browser Geolocation, they help websites build a much more reliable estimate of where you are.
Cookies and Browsing History
If you've previously shared your location with a service such as Google or Facebook, it may remember that information by storing it in a cookie or associating it with your account. As a result, you won't necessarily be asked for your location every time you visit the site.
That's why some websites can display local content immediately without showing the familiar location permission prompt. In many cases, they're simply using location information you've already allowed them to store, rather than requesting it again.
Advertising platforms go a step further by combining location data with your browsing history and other signals to build a more complete profile of your interests and habits. This makes location tracking significantly more effective, even when no single piece of information reveals your exact location.
For example, if you regularly browse restaurant listings, local news, or online marketplaces focused on a particular city, those browsing patterns reinforce the likelihood that you're located there—or at least have a strong connection to that area.
Mobile App Location Data
On smartphones, many apps request access to your location directly through the operating system (Android or iOS). If you grant permission, Location Tracking becomes highly accurate because the app can use the device's built-in location services, which combine GPS, nearby Wi-Fi networks, and cell towers to determine your position.
It's important to note that these app permissions are completely separate from your browser's Browser Geolocation permissions. That's why Android and iOS let you manage location access for each app individually in the device's Settings. An app may have permission to access your location even if your browser doesn't—and vice versa.
Photo Metadata (EXIF Geotagging)
One often-overlooked source of location information is your photos themselves. Every time you take a picture with your smartphone, the image automatically stores metadata such as the capture date, camera model, and device information. If location services are enabled, it can also embed the exact GPS coordinates of where the photo was taken.
If you upload that original photo to a forum, post it on a personal website, or email it to someone, anyone with access to the original file can inspect its EXIF metadata and potentially see where it was taken—without ever requesting your location directly.
The good news is that most major social platforms, including Facebook, Instagram, and WhatsApp, automatically remove most or all EXIF location data from uploaded images as a privacy safeguard.
However, if you send a photo as an email attachment or upload it to a smaller website or file-sharing service, the original EXIF metadata may remain intact unless the service strips it automatically.
If you want to eliminate the risk of Location Tracking through your photos, you have two options: disable geotagging for your camera app so future photos don't include GPS coordinates, or remove the EXIF metadata before sharing images using a tool such as ExifTool.
Geofencing: A Virtual Boundary Around You
Geofencing is a location-based technology that creates a virtual boundary around a specific area. When your device enters or leaves that boundary, an app can automatically trigger a predefined action.
Some common examples include:
- Retail stores sending you a push notification with a special offer as you walk near one of their locations.
- Family safety apps notifying parents when a child arrives at or leaves school.
- Smart home systems automatically turning on the lights, adjusting the thermostat, or opening the garage door as you approach home.
Geofencing typically relies on a combination of GPS, Wi-Fi, and sometimes Bluetooth to detect your proximity to a specific location. Like other forms of precise Location Tracking, it requires your permission to access your device's location, and many apps also need background location access if they're expected to trigger events while you're not actively using them.
How Advertising Platforms Use Location Data for Targeting
Google Ads and Meta Ads are among the best-known examples of large-scale Location Tracking in online advertising. They allow businesses to show ads only to people in specific geographic areas, making campaigns far more relevant—and often more cost-effective.
When creating a campaign, an advertiser can target users in a particular country, region, city, or even within a radius of just a few miles or kilometers around a physical store. This lets a local business reach nearby customers, while a global brand can include or exclude entire countries as needed.
To determine whether someone matches the selected location, advertising platforms combine multiple signals, including:
- The user's IP address at the time the ad is displayed.
- The device's precise location, if the user has granted location permission to the Google or Facebook app on their smartphone.
- Historical location data associated with the user's account, when available and enabled.
- Signals from nearby Wi-Fi networks, Bluetooth, and cell towers, which can improve location accuracy on mobile devices.
The result is highly precise ad targeting. A neighborhood coffee shop can advertise only to people who are nearby, while a multinational company can run entirely different campaigns for different countries—or exclude certain regions altogether. Google notes, however, that location targeting is based on multiple signals and represents its best estimate rather than a guarantee of a user's exact location.
If you'd like to see what Google knows about you in this area, you can review your Google Account privacy and advertising settings, including My Ad Center and your Location History controls, by visiting Google Account. There, you can manage the location data Google uses across its services and choose whether it's used to personalize the ads you see.
What Are the Real Risks?
So far, we've focused on the convenience that Location Tracking provides. But it's equally important to understand the privacy and security risks that come with it.
- Stalking and harassment: If a malicious person gains access to your location—through a photo containing EXIF metadata, an overly permissive app, or another source—they may be able to identify where you live, work, or spend your time.
- Targeted phishing scams: Knowing your city, neighborhood, or even places you frequently visit allows scammers to craft far more convincing phishing messages and social engineering attacks.
- Home security: Public social media posts with location tags can reveal that you're away from home, potentially increasing the risk of burglary.
- Excessive data collection: Many apps request location access even when it's not essential for their core functionality. In some cases, that data may be shared with or sold to data brokers, who aggregate and resell location information for advertising and analytics.
- Wi-Fi and Bluetooth tracking in public places: Even when you're not connected to a network, nearby wireless signals can sometimes be used by retailers, airports, or shopping malls to estimate your movement through a building for analytics or marketing purposes.
That doesn't mean you should panic or disable every location feature on your devices. Location Tracking is now a fundamental part of how many online services work. The key is to understand what information you're sharing, review the permissions you grant to apps and websites, and think twice before posting content that could reveal where you are—or where you aren't.
How to Control What You Share
If you want more control over the location data websites collect about you, there are a few simple steps you can take:
- Review your browser's location permissions. In Google Chrome, open
chrome://settings/content/locationto see which websites have already been granted access to your location. You can remove individual permissions or change the default setting so Chrome always asks before sharing your location. - Do the same in other Chromium-based browsers. In Microsoft Edge, go to
edge://settings/content/location, while in Brave, openbrave://settings/content/location. From there, you can review existing permissions or block location requests altogether. - Turn off location services when you don't need them. Disabling GPS—especially on your smartphone—prevents apps from accessing your precise location and forces many services to rely on less accurate methods, such as IP geolocation.
- Use a reputable VPN if you want to mask your IP-based location. A VPN can make websites see the location of the VPN server instead of your own public IP address. Keep in mind, however, that it does not hide your location if you explicitly grant access through Browser Geolocation or a mobile app.
Can a VPN Hide Your GPS Location?
It's important to understand that most VPNs only change the location associated with your public IP address. If you grant a website access to Browser Geolocation or allow a mobile app to use your device's location services, your real GPS location can still be detected—even while you're connected to a VPN.
There is, however, one notable exception. On Android, Surfshark VPN includes a feature called GPS Override. When enabled, it synchronizes your device's reported GPS location with the location of the VPN server you're connected to, making GPS-enabled apps believe you're in that location instead.
This significantly reduces the chances of GPS-based apps and services revealing your real location, adding an extra layer of privacy beyond simply masking your IP address. Keep in mind, though, that GPS Override is currently available only on Android, and it requires additional setup because it uses Android's mock location framework.
You can find this feature by going to Settings → VPN Settings → Advanced Settings in the Surfshark Android app. There, you'll see the Override GPS location option.
Before you can enable it, you'll need to turn on Developer Options on your Android device. Once you tap Override GPS location, the Surfshark app will guide you through the remaining setup steps automatically.
Next, open Developer Options (on Xiaomi devices, they're under Additional settings), scroll down to Select mock location app, and choose Surfshark from the list of available apps.
After that, return to Advanced Settings in Surfshark, and you'll be ready to enable Override GPS location whenever you need it.
In practice, this feature is most useful for apps and services that rely primarily on GPS rather than IP-based location. By aligning your reported GPS location with your VPN server, it helps maintain greater consistency between your network location and your device's geographic location, reducing the chances of revealing your real whereabouts.
If you don't use this feature—or your VPN doesn't offer it—it's still worth following a few basic privacy practices:
- Review your app permissions and allow location access only for apps that genuinely need it.
- Clear your cookies and browsing data periodically so websites are less likely to remember previously stored location information.
- Disable photo geotagging in your phone's camera settings, or remove EXIF metadata before sharing images, to avoid unintentionally revealing where a photo was taken.
Surfshark VPN + An Extra Privacy Advantage
Surfshark isn't just one of the leading VPN services on the market—it's also one of the most affordable. It follows a strict no-logs policy, meaning it doesn't record your browsing activity, and that policy has been independently verified by Deloitte, one of the world's largest auditing firms. Surfshark has since undergone multiple independent no-logs audits, reinforcing its privacy claims.
Another standout feature is that a single subscription supports unlimited simultaneous device connections. Unlike many VPN providers that impose a fixed device limit, Surfshark lets you protect as many of your personal devices as you want under the same account.
The Bottom Line
Location Tracking has become a core part of the modern web. It powers everything from maps and weather forecasts to fraud prevention, local search, and personalized recommendations. At the same time, the same technologies can reveal far more about our daily lives than most of us realize when they're used without careful privacy controls.
The goal isn't to avoid location-based services altogether, but to understand how they work and make informed choices about the permissions we grant. A quick review of your browser, apps, and device settings can go a long way toward protecting your privacy—without giving up the convenience of the services you use every day.
Support PCsteps
Do you want to support PCsteps, so we can post high quality articles throughout the week?
You can like our Facebook page, share this post with your friends, and select our affiliate links for your purchases on Amazon.com or Newegg.
If you prefer your purchases from China, we are affiliated with the largest international e-shops:
