THE INSIDER’S GUIDE TO IP GEOLOCATION DATA
This white paper presents the insights and information you need to better understand IP geolocation decisioning data, such as: How businesses use it. Insights into accuracy, and how it can be improved. The effects of changes in internet technology and usage. Why new privacy regulations make it more valuable than ever. Why the choice of provider is particularly critical.
Powering Business Applications
In most instances, IP geolocation data is received by making a request to a geolocation database. This database can be housed on premise at the customer’s site or hosted by the geolocation data provider. This call returns data insights about the IP address, including details about where the IP is located, how the IP is connecting to the internet, and insight into the organization behind the IP address.
IP geolocation data delivers foundational decisioning insights that power critical business applications in multiple industries, every hour of every day. Understanding this data and what it can help you accomplish is essential to the success of your online business.
If you use IP geolocation data, you already know how it supports your specific business application. But you may not know what else it can support in your enterprise.
ONE DATA SOURCE, MANY APPLICATIONS
Today’s connected businesses have a huge stake in knowing as much as possible about the devices and people logging on to their online resources. But they must collect and evaluate that information virtually instantaneously, for each inbound connection.
IP geolocation data provides a critical element in that needed intelligence, delivering the geographic location of the IP address, information about the characteristics of the network connection, and, from some providers, insights about anonymizing connections.
This information is crucial to many different critical business functions, such as:
- Media and content distribution, by ensuring eligibility for access to restricted or copyrighted content or streaming media
- Customer experience, by enabling geographically targeted, localized content and reducing friction throughout the customer journey
- Cyber security and threat intelligence, by helping to identify potential threats to the corporate infrastructure and preventing access by unauthorized users
- Fraud prevention, by helping to identify potentially fraudulent transactions
- Legal and regulatory compliance, by restricting or blocking unauthorized access to websites or content that could result in fines or penalties
- Gaming and gambling compliance, by preventing access from users in restricted locations
With such a rich suite of applications, it’s no wonder that IP geolocation data is in constant daily use in industries from financial services to retail and ecommerce, from OTT and streaming media to government.
Where Do IP Addresses Come From?
IP address allocation begins with the Internet Assigned Numbers Authority (IANA) and the five regional internet registries (RIRs) responsible for managing the global space.
The RIRs allocate their IP address blocks to ISPs, universities, governments, and organizations that are large enough to administer their own IP networks, which in turn subdivide them into smaller blocks to be dynamically assigned for use on active networks
Why it’s hard to say, #3: Non-invasive data collection. IP geolocation data is not an opt-in service. It does not involve the use of technologies such as GPS in mobile devices to pinpoint a user’s location within a few meters.
In fact, geolocation data doesn’t require users to opt in to anything. That’s a disadvantage for precision—but a significant advantage in an era of growing skepticism about invasive opt-ins, as well as greater concerns and regulations regarding data privacy.
Bottom line: How accurate is it? Neustar’s Ultra GeoPoint provides location data that’s accurate to the city or postal code level. It’s accurate enough to provide decisioning data to drive:
- Geofencing of content delivered (or accessed) virtually anywhere in the world
- Legal and regulatory compliance for restricted content
- Compliance for gaming and gambling
- Improved customer experiences through localization and friction reduction
It cannot locate a user to a specific business or home. Period. What about those confidence codes? Some providers, including Neustar, include a confidence factor as part of their IP geolocation dataset. In our case, it’s derived from a number of data points associated with the IP address and the connection, including routing type, ASN, hand-mapped input, and other factors. Higher confidence factors indicate a higher number of inputs that agree upon the current assigned location.
One Practice to Avoid
When an IP address can’t be resolved to a specific location, it shouldn’t be arbitrarily assigned to one - say a farmhouse in Kansas that happens to be near the geographic center of the 48 contiguous United States. When one provider had 600 million IP addresses that could only be resolved to the US, it identified that home as the location for all of them. This resulted in countless visits from police and sheriff’s officers, FBI agents, federal marshals, IRS collectors, ambulances, and even angry internet users. Ask your provider how it handles that situation!
These data resources improve insights into the location of devices connecting through mobile gateways. Similarly, a provider may have relationships with ISPs to obtain information about new or reallocated IP address blocks.
When incorporated into the data synthesis process, this kind of high-quality supplemental data expands coverage, improves insights into IP address blocks, and ultimately strengthens the accuracy of geolocation placement.
Geo-feedback and updating processes: What does your data provider do when you discover a location is inaccurate? Responsible providers encourage a two-way flow of information with their customers. They not only welcome feedback about inaccuracies; they also have an established procedure to use it to improve data accuracy.
A provider can give its clients a simple tool, such as an online form to report an IP address that has been inaccurately located, then ingest or review the information via a formal process that ensures it’s incorporated into the database.
Five to seven percent of residential IPs change on a weekly basis.1 Strong providers therefore update their geolocation database regularly and often, incorporating client-provided geofeedback along with data from all other sources. The Neustar UltraGeoPoint database is updated weekly at a minimum, with daily ad hoc updates delivered upon request.
In the physical world, smart crooks wear masks to avoid identification. In the online world, they use IP anonymizers. Criminal intent isn’t the only reason someone might want to remain anonymous online. But the ability to identify connections made through anonymous internet proxies is a critical capability for many users of IP geolocation data.
When geographically regulated services such as online gaming and gambling sites began using IP geolocation data to create geofences that excluded prohibited participants (often US citizens), determined gamers looked for a way around it.
Similarly, when bad guys are trying to defraud a busy ecommerce operation, they need an easy, effective tool to cover their tracks.
Enter the anonymous proxy. And because the fraudsters who hide behind them can bring serious consequences to legitimate online businesses—fines and penalties in the first case, top-line losses in both cases—it’s important to be able to identify these anonymous visitors when they log in.
Identifying proxies. Naturally, they don’t announce themselves. A provider must have superior network-level information and signals to identify suspected proxies and other anonymizers. The provider then needs to test suspected proxies to validate those that are active, at which point it can add active proxies to its geolocation database, and if necessary, flag them as high risk.
But inactive doesn’t mean gone forever—nor, for that matter, will an active proxy necessarily remain that way. Providers must regularly retest both suspected and validated proxies to ensure they are accurately accounted for and identified.
Version 6 of the IP address specification (IPv6) is now in widespread use. Mobile devices now account for roughly half of internet traffic worldwide. How providers are handling these significant shifts in internet access is critical to the value of the IP geolocation decisioning data they offer.
Setting the Bar High, Right from the Start
Data privacy is not a new concern for Neustar. We have adhered to our principles of Privacy by Design for more than 20 years, incorporating respect for personal privacy into the design, development, and delivery of our data products and services since our founding. That includes UltraGeoPoint.
We take our responsibilities seriously as a steward in the collection and protection of consumer data, to support the delivery of trusted connections between companies and people without sacrificing personal privacy.
The shift to PI. GDPR refocused interest from Personally Identifiable Information (PII) to Personal Information (PI)—and that one little letter makes a huge difference. PI is a much broader concept that is applicable to anything that can be used to identify, describe, or link directly or indirectly to an individual or household. It includes persistent IDs, even if they’re pseudonymous, such as cookie IDs, IP addresses, a hashed email and geolocation data—along with all associated attributes. IP geolocation data has never been intended to locate consumers to a specific home or business or to identify a specific consumer. In part, its value has always been based on the fact that it doesn’t require a consumer opt-in to deliver critical decisioning insights to data-driven companies. That’s more true now. But geolocation data can include PI as defined by GDPR—unless your provider ensures that it is stripped from the data you receive. Make sure your data provider is fully compliant with the laws and regulations that apply to your business. The potential consequences are simply too serious to ignore, as are the benefits of privacy-compliant geolocation insights.
No other data currently available—or on the horizon—can provide the same foundational insights to drive robust security solutions, ensure regulatory compliance, and support more positive customer experiences.
As long as those functions remain important, so will IP geolocation data.