Geolocating Visitors for Consent: Is It Acceptable, and Is It Reliable?

How Does Geolocation Set Consent Policy?

Privacy rules differ by region. Europe requires opt-in consent for most web tracking, while U.S. state privacy laws generally permit an opt-out model, although wiretapping case law complicates that picture. As a result, many organizations want hybrid consent policies rather than a single global policy that is either too restrictive or too risky.

Consent platforms address this by estimating where visitors are from their IP addresses and applying the model for that region. For example, a platform may apply an opt-in model to visitors from Germany by default, while applying an opt-out model to visitors from Michigan.

This practice is widespread, including among major technology companies. Google and Shopify both build it into their tools. Google's consent mode documentation tells website owners to "specify a region" in order to set default consent states "that apply to visitors from particular areas." Shopify also applies its consent settings by region.

Is the Location Lookup Itself a Privacy Concern?

Every website receives visitors' IP addresses, because they are fundamental to how websites communicate with browsers. An IP-based lookup collects nothing new from visitors' devices. Rather, it derives a coarse location from data the website already has.

The IP address and the location derived from it are still personal information. California's privacy law lists IP addresses among the identifiers that count as personal information, so the lookup should be addressed by the privacy notice. Where a consent platform or a separate geolocation vendor performs the lookup, that vendor should be bound by service provider terms.

However, the location that results from IP address mapping is coarse. State privacy laws treat precise geolocation as sensitive data, but they typically define it as data that locates a person within a radius of 1,750 feet (or 1,850 feet in California). IP-based location is extremely unlikely to meet that definition. For example, ipify, a widely used provider, says that its locations "normally point to the center of the city," and that its data does not include street names.

The purpose is also relevant. A lookup that only decides which banner policy to activate, and is not stored or shared with advertising tools, serves the consent process rather than non-essential tracking.

In Europe, the ePrivacy rule on cookies requires consent before information is stored on or read from visitors' devices, unless it is strictly necessary to provide a service that visitors requested. Regulators' 2024 guidance says that tracking based on IP addresses can fall under that rule. However, it adds that this "does not systematically mean that consent needs to be collected," because the exemption for strictly necessary uses may still apply.

How Accurate Is IP-Based Geolocation?

IP geolocation is reliable at the country level and less reliable below it. One widely used provider publishes the estimates below. It also notes that accuracy is lower for visitors on mobile networks, business VPNs, and consumer privacy networks.

Approximate figures from one widely used geolocation provider, as of October 2026.

This means that IP address data is usually dependable for choosing between a European model and a U.S. model, and less so for telling U.S. states apart.

IP location also shows where visitors are at the moment (VPNs and similar services aside), not where they live. That fits the GDPR, which protects people "who are in the Union," better than U.S. state privacy laws, which protect residents.

Where Does Geolocation Create Risk?

The clearest risk is to opt-out rights. In August 2026, Senator Ron Wyden wrote to ten state attorneys general and the chair of California's privacy agency about businesses that use geolocation to decide whose opt-out signals to honor, including the Global Privacy Control (GPC). His letter says that many companies are "relying on flawed geolocation data to selectively ignore consumer opt-out requests." It adds that visitors' "temporary physical location does not dictate their state of residence."

The letter also describes who is affected. It names out-of-state college students, business travelers, interstate commuters, and military personnel stationed away from home. It notes that visitors who use VPNs appear to be wherever the VPN server is located, so filtering by location "perversely punishes" the privacy-conscious residents who are most likely to enable the signal.

California's position is direct. Agency staff told the senator's office that California consumers keep their rights "regardless of where they are physically located." According to the letter, several consent platforms already honor the signal from all visitors, regardless of IP address. The letter urges the attorneys general to tell businesses that ignoring signals based on IP address is impermissible unless visitors are notified and given "a frictionless way to self-certify their true residency."

Some businesses also apply an opt-in model only to visitors who appear to be in California, to reduce their exposure to CIPA wiretapping claims. Given the accuracy figures above, some California visitors are likely to receive the opt-out model instead.

What Is a Reasonable Approach?

The rules themselves are part of the problem, because state privacy laws attach rights to residency, which websites cannot determine for anonymous visitors without asking them. In 2020, California's Attorney General acknowledged that whether IP-based location "is reliable and definitive of residency raises specific legal questions." Several states tie the duty to honor opt-out signals to what businesses can determine through "commercially reasonable" efforts, yet a research memo attached to the senator's letter concluded that it is "unclear whether a court would accept the use of an IP geolocation database" as one.

Geolocation remains a practical way to apply different consent models. I am not aware of a regulator that has prohibited it. I am also not sure that there is a better model. Businesses that use it have a few common ways to limit its weaknesses:

• Keep the lookup to its purpose. The location should be used only to choose the consent model, not stored with visitor profiles or shared with advertising tools.
• Apply opt-out rights broadly. Opt-out signals and requests can be honored for all visitors, not only those who appear to be in certain states.
• Choose a default for uncertain locations. Consent platforms cannot always tell where visitors are, so the default for those cases should be chosen deliberately.
• Keep regional settings consistent. The consent platform, the tag manager, and the e-commerce platform should apply the same regions.

Some businesses avoid these questions by applying one model to all visitors, which is simpler but more restrictive or riskier than necessary in some regions. Leadership and counsel should decide whether to vary the model by region, and how narrowly. Either way, the reasons for the choice should be documented.

For the most privacy-conscious websites, some consent platforms allow location lookups to be disabled entirely. At Captain Compliance, we offer that option. As I write this Briefing, this website uses it. Its location cookie, cc_consent_cc-modal-user-location, records a null region because every visitor is shown the same opt-in model by default, so there is no reason to perform a lookup.