Your IP address tells a website which network you are connecting from: the provider that owns the address block, the country and usually the city or region it is allocated to, and whether it belongs to a home connection, a mobile carrier, a business or a data centre. It does not reveal your name or street address; only your provider can make that link, and only under legal compulsion.
What an address is and who assigns it
Every packet you send carries a source address so the reply can find its way back. The address is not yours in any permanent sense: it belongs to a block allocated by a regional registry (ARIN, RIPE NCC, APNIC and the others) to an organisation, usually your internet provider, which lends one to your connection. Anyone can look up who holds the block, and that lookup is the source of most of what an address "reveals". A typical query returns something like this:
$ whois 203.0.113.42
inetnum: 203.0.113.0 - 203.0.113.255
netname: EXAMPLE-BROADBAND-NORTH
descr: Example Telecom residential pool, Manchester
country: GB
origin: AS64496The registry record gives the provider, the country and often a descriptive name that hints at the region and the kind of customer. The autonomous system number (AS64496 above) identifies the network on the global routing table. Commercial geolocation databases refine this with data from routing, latency measurements and, for some providers, address blocks known to be assigned to particular cities. That is the entire basis for "your location" on a map: an educated guess about where a block is used.
What it reveals, and how precisely
| Attribute | Reliability | Source |
|---|---|---|
| Country | High | Registry allocation |
| Provider / ASN | High | Registry and routing table |
| Region or city | Moderate; often wrong for mobile and for large providers | Geolocation databases |
| Connection type (home, mobile, business, hosting, VPN) | Moderate to high | Block classification |
| Street address, name | Not derivable | Provider's customer records only |
The precision claims made by "what is my IP" sites deserve scepticism. Geolocation vendors publish their own accuracy figures, and city-level accuracy varies widely by country and provider; mobile carriers in particular route traffic through a few regional gateways, so a phone in one city often geolocates to another hundreds of kilometres away. A home broadband address in a dense urban area is the most precisely located case, and even then the answer is a neighbourhood, not a building.
What the address cannot do is name you. The provider keeps a log of which customer held which address at which time, and that log is released to law enforcement or to a court order, which is how copyright and abuse cases reach individuals. Absent that process, a website that knows your address knows a network, not a person.
What a server stores alongside it
The address rarely arrives alone, and what makes it useful to a site is the company it keeps. A standard web server log line records the address with the time, the request, the referring page and the browser's user agent string:
203.0.113.42 - - [07/Jul/2026:09:14:02 +0000] "GET /pricing HTTP/1.1" 200 8412 "https://search.example/?q=example+pricing" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15"From that single line the operator knows the network you came from, when, which page you wanted, what you searched for to get there and roughly what device you use. Logs like this are kept for weeks to years depending on the operator's policy, are routinely shared with analytics and security vendors, and are what a subpoena for "server records" actually returns. The address is the join key that ties the lines together into a history of one visitor, which is why anonymising a log by truncating the last octet of each address, as some analytics products do by default, is a meaningful privacy measure rather than a cosmetic one. It is also why the address matters more for a small, self-hosted site whose logs are read by a person than for a large platform that already knows your login.
How websites use it
Sites use the address for far more than a map pin, and most of the uses are legitimate:
- Geo-restriction and localisation: choosing a language, currency or catalogue, and enforcing licensing regions for video.
- Fraud and abuse scoring: a login from a data-centre address, a known VPN range or a country the account has never used raises risk. This is why a VPN triggers extra verification at banks.
- Rate limiting and blocking: too many requests from one address gets it throttled or banned, which is also why shared addresses sometimes hit limits you did not cause.
- Ad targeting: regional campaigns keyed on the geolocated area.
- Tracking: the weakest use, but real. On a home connection whose address changes rarely, the address plus a coarse fingerprint can link sessions after cookies are deleted. The tracking guide ranks it against the other signals, and the fingerprinting guide explains the stronger identifier it is usually combined with.
The tracking use is where the address matters most for privacy, and it matters in a specific way: it is a linking key for a household, not an identifier for a person. Everyone behind your router shares it, and a tracker that leans on it conflates them. That is a limit of the technique, and also a reason to be careful about what "anonymised" IP-level data can still reveal about a small household.
Shared addresses, private addresses and IPv6
Three developments have changed what an address means since the 2000s. Carrier-grade NAT (RFC 6598 sets aside the range for it) puts hundreds or thousands of mobile and some fixed-line customers behind one public address, so an address seen by a site may correspond to a whole city's worth of users. IPv6 gives each device a globally unique address, which at first made tracking easier, until temporary addresses (RFC 8981) became the default on major operating systems: the device generates a new random interface identifier daily and uses it for outgoing connections, so the low bits of your IPv6 address no longer identify the device. The network prefix still identifies your connection, so IPv6 is roughly as revealing as a single IPv4 address, not more.
The practical point is that an address is a coarse and unstable key on mobile networks and a fairly stable one on home broadband. If your provider gives you a static address, it is a persistent identifier for your household for as long as you keep the contract.
How the address leaks
The address is sent to every server you contact; that is not a leak, it is how the internet works. A leak is the address reaching someone you did not intend, or reaching a site despite a tool meant to hide it.
When you send mail through a desktop client, many providers record the submitting address in a Received: header that travels with the message:
Received: from [192.0.2.17] (host-192-0-2-17.example-isp.net [192.0.2.17])
by mail.example (Postfix) with ESMTPSA id 4Xk9Q2Lz7m
for <[email protected]>; Mon, 6 Jul 2026 09:14:02 +0000Webmail interfaces generally do not include the sender's address, but the header above is common with SMTP submission. In the other direction, a tracking pixel in a message you open reports your address to the sender the moment the image loads, unless your client blocks remote images or proxies them.
WebRTC
WebRTC gathers your network addresses so browsers can connect directly, and a page can read the result. Behind a VPN this can expose the address the VPN was meant to hide. The WebRTC leak guide covers the mechanism; the WebRTC leak test shows what your own browser exposes, and the WebRTC IP leak check in our browser check reports it alongside the client hints that reveal platform details a site can combine with the address.
Direct connections
Peer-to-peer file sharing, voice calls in some messaging apps, online games and any application that opens a direct connection to another user exposes your address to that user. This is the classic route to a targeted denial-of-service attack in gaming, and the reason those apps offer a relayed mode.
Links and embedded content
Any link you click or image that loads contacts the host directly. A one-pixel image in a forum post, a link shortener the sender controls, or a document that loads a remote template all report your address to whoever runs the server. Sometimes that address collection is the first step of something worse.
Realistic ways to limit exposure
- Decide who you are hiding from. Hiding from the local network and ISP is a VPN's job; hiding from the destination is Tor's; the VPN, proxy and Tor comparison explains why they are not interchangeable.
- Test the tool. Run the WebRTC leak test with the tunnel active and confirm the address it reports is not your provider's.
- Block remote images in your mail client, or use a provider that proxies them.
- Prefer relayed connections in games and calls when talking to strangers.
- Confirm IPv6 temporary addresses are enabled on your devices; they are the default on current Windows, macOS, iOS and Android, and on most Linux desktops.
- Accept the remainder. A site you log into knows who you are regardless of your address; do not spend effort hiding an address from a service that has your name.
The privacy hub sets the IP address in context with the identifiers that matter more, and the secure DNS guide addresses the related question of who sees the names you look up.
