How Websites Know Where You Are (and How to Control It)
A website can know your location three ways: precisely, if you grant the browser's location permission (GPS/Wi-Fi, meters); roughly, from your IP address (city-level, no permission needed); or historically, from GPS coordinates embedded in photos you share. Each has its own off switch — and none of them lets a site silently track your GPS without the permission prompt.
Channel 1: the permission prompt (precise, consent-based)
The only way a website gets your precise position is the browser's Geolocation API — the 'Allow this site to access your location?' prompt. Behind it, the OS fuses GPS, Wi-Fi and cell signals (see how GPS accuracy works) and hands the page one set of coordinates, typically accurate to a few meters. Two things people misjudge: a site cannot invoke this silently — the permission is per-site, revocable, and visible in the address bar — and 'while using' really means that; background tracking from a browser tab isn't a thing the API allows. This site uses exactly this channel when you tap the locate button, and the coordinates never leave your browser: the lookup pages are built so the position is displayed client-side, not logged.
Channel 2: your IP address (coarse, automatic)
Every server you contact sees your IP address — it has to, to send the reply. Commercial databases map IP blocks to places, which is how a site guesses your city with no prompt at all. It's coarse and often wrong: typically right at country level, hit-and-miss at city level, and never house-level. Check what your IP reveals on the what-is-my-IP page, and read why IP location is so often wrong for the mechanics. The only way to change what this channel shows is to change your apparent IP — a VPN or Tor — since it exists below the level of browser settings. Whether yours actually masks you is testable on the VPN checker.
Channel 3: what you upload (photos, files, posts)
Phones embed GPS coordinates in photo metadata (EXIF) by default. Share the original file and you share where it was taken — sometimes down to which room. The good news: major messengers and social networks strip EXIF on upload, so the common leak is direct file transfers, email attachments, cloud links, and marketplace listings. Our photo location tool reads a photo's EXIF entirely in your browser so you can see what a file would reveal, and downloads a cleaned copy with the GPS removed. GPX/KML exports from fitness apps deserve the same caution — a running heatmap that starts and ends at your front door is an address.
Fingerprinting: location's quieter cousin
Beyond location, sites can try to recognize you across visits by combining traits your browser exposes freely — screen size, fonts, GPU string, timezone, language list, canvas rendering quirks. No single trait identifies you; the combination often does. Your timezone alone reveals your region even behind a VPN, which is one of the checks our VPN checker performs. Run the browser privacy check to see your own fingerprint surface and whether WebRTC leaks your real IP — the two tests that matter most, done locally in your browser.
A sane settings checklist
Five minutes of hygiene covers most of it. Review site location permissions (Chrome: Settings → Privacy → Site settings → Location; Safari: Settings → Websites → Location; Firefox: Settings → Privacy & Security → Permissions) and remove sites you don't recognize. Set camera GPS tagging to your preference — you can leave it on and strip per-share instead. If you use a VPN, verify it with the leak tests above rather than trusting the app's green shield. And calibrate rather than panic: the permission channel is consent-gated, the IP channel is city-coarse, and the upload channel is under your control. Precise, silent, involuntary tracking of your GPS by a website isn't how the web platform works.