Senator Wyden Called GeoIP "Flawed." How to Use IP Geolocation for GPC Opt-Outs Without Proving Him Right

On August 3, 2026, Senator Ron Wyden wrote to the attorneys general of California, Colorado, Connecticut, Delaware, Maryland, Montana, Nebraska, New Hampshire, New Jersey and Texas, plus Jennifer M. Urban, who chairs the board of the California Privacy Protection Agency, about a specific engineering choice. Some businesses honor the Global Privacy Control signal only when a GeoIP lookup places the visitor inside a state whose law requires it. Everyone else gets tracked. The letter calls the lookup data "flawed," says GeoIP databases are "notoriously inaccurate," and names the people who pay for it: out-of-state college students, business travelers, interstate commuters, service members stationed away from home, and anyone on a VPN.

We sell that data, so we have an interest in this. Our read is that the senator is right about the weakness and wrong only if his letter gets read as "IP geolocation is useless." State is the field where a lookup is least reliable, for reasons that come from how carriers and hosting networks are built rather than from any one vendor's diligence. No database is accurate enough to fix that. A rule about which direction the data may push a decision is.

What the letter asks for, and what already happened

The requests are short. Regulators should publish guidance that businesses must respect GPC signals from their residents "regardless of their physical location or IP address," VPN included. Dropping a signal because of the IP should be "impermissible unless they clearly notify users and provide them with a frictionless way to self-certify their true residency." And the ten states should form a bipartisan multistate task force to enforce universal opt-out rules together. By the letter's own count, the privacy laws of a dozen states now give residents the right to use a universal opt-out mechanism, with Alabama, Louisiana and Vermont enacted but not yet in force; the letter went to ten of the twelve.

The enforcement record makes the ask less abstract. California settled with Sephora for $1.2 million in 2022, with Healthline for $1.55 million in 2025, and on February 11, 2026 Attorney General Rob Bonta announced a $2.75 million settlement with Disney, the largest CCPA penalty so far, over opt-outs and GPC signals that applied only to the device or service where they were received. Since January 1, 2026, revised section 7025(c)(6) of the California regulations says a business "must display" whether it processed the signal, where the old text said "may." Wyden's complaint about the dark pattern, an "honored" badge on acceptance and silence on rejection, lands on a rule that already exists. His verdict on the asymmetry: it "effectively morphs a transparency rule into a cloaking device for non-compliance."

The industry answer came from David LeDuc of the Network Advertising Initiative, who told MediaPost that "there are limitations to IP lookups" and called them "one of the best arguments for a national standard." Nobody disputed the technical premise.

State is the weakest field in the lookup

Country-level geolocation is settled by registry delegations, routing, and the plain fact that almost no last-mile network crosses a national border. The "Lost in the Prefix" measurement study published earlier this year put fewer than 1 percent of observations in the wrong country across four commercial databases. State is different. No registry records a subdivision, most operators do not publish a geofeed, and the inference has to come from where an address first touches the public internet.

For fixed broadband that works well enough, because a cable or fiber aggregation point usually sits in the same state as the homes it serves. Usually. The Portland metro straddles the Columbia River, and Vancouver, Washington is served as part of the same market as Portland, Oregon, the senator's own state. Five of the ten states on his list are small states whose residents commute into an out-of-state metro: New Jersey and Connecticut into New York City, Maryland into Washington, Delaware into Philadelphia, New Hampshire into Boston. A database can only report where the network hands the traffic off, and on the edge of a metro that is often the wrong side of the line.

Mobile is where the field falls apart. A phone never holds a public address. Its traffic rides an encapsulated tunnel across the carrier's backbone to a packet gateway (the P-GW in 4G, the UPF in 5G) and only there does it pick up a public source address, from a carrier-grade NAT pool shared by tens of thousands of subscribers. Geolocation cannot see past that gateway. The same study measured the median mobile error at 179 to 207 km against 3 to 16 km on fixed lines, and found that about 70 percent of mobile prefixes cover more than 100 km of real subscriber locations. We wrote up the mechanics last month, and nothing in them is specific to the Global South.

Hosting and VPN address space carries no subdivision signal at all, because the address belongs to a rack. Corporate VPNs put a Denver employee in Virginia; consumer VPNs put anyone anywhere. The one exception runs the other way: Apple's iCloud Private Relay keeps the user inside their own region and publishes the egress ranges with country and region attached, so a relay user is the rare anonymized visitor whose state you actually know.

Military users are their own case. Traffic from a base that rides Department of Defense networks reaches the public internet through a small number of DISA internet access points, none of them where the user is, and the ARIN records for DoD blocks point at the DoD Network Information Center in Columbus, Ohio. Wyden writes that foreign adversaries "have actively exploited commercial adtech data to surveil, profile, and target American service members," a claim the Pentagon confirmed in writing to Congress for deployed personnel, made public on May 28, 2026, which is why TrustArc has agreed to treat government and military ranges as California traffic and Transcend is shipping an optional high-sensitivity classification for the same ranges by the end of 2026.

The errors are not symmetric, so the rule should not be either

Here is the observation that turns a data-quality problem into a design decision. A geofence that consults the IP before honoring GPC can be wrong in two directions. Put a Massachusetts visitor in Connecticut and you grant an opt-out that Massachusetts law never required. Put a Connecticut visitor in Massachusetts and you have ignored a signal that Connecticut's statute says is a valid opt-out request. The first error costs a little ad revenue on one session. The second is what Sephora, Healthline and Disney paid for.

Both errors come from the same field with the same error rate, so the only configuration that cannot produce the expensive one is a configuration where the IP never subtracts. Honor the signal for everyone. Then look at the address, and let it add rights specific to the state it resolves to.

The objection is obvious: this opts out visitors from Ohio and Georgia, whose legislatures have required no such thing. To be fair, that is a real cost, and Wyden's answer to it is that "some of the largest companies in America" already pay it by honoring GPC from every visitor. The counter is arithmetic. The signal is on by default in Brave, DuckDuckGo, Tor Browser and Mullvad Browser and in Firefox's private windows, so the revenue at stake in a non-enforcing state is the opt-out rate of a privacy-conscious minority. California's AB 566 will require every browser to offer the setting by January 2027, and at that point the geofence becomes a policy you have to defend.

Where the IP still earns its keep

None of this makes the lookup worthless. The universal opt-out laws are not identical, and the extra rights are where the IP does useful work. Colorado's signal covers targeted advertising and sale; New Jersey's reaches profiling. A visitor whose address resolves to US-CO on a fixed consumer connection with no anonymizer flags is very probably in Colorado, and applying Colorado's wider set costs nothing if they are not. For a Comcast subscriber on a fixed line in Denver the response looks like this, and every field in it raises confidence in the region:

{
  "location": {
    "country": { "code": "US" },
    "region":  { "code": "US-CO", "name": "Colorado" }
  },
  "connection": { "asn": 7922, "type": "isp" },
  "carrier":    { "name": null },
  "security": {
    "is_vpn":   false,
    "is_proxy": false,
    "is_relay": false,
    "is_tor":   false
  }
}

The scoring rule is three lines. A non-null carrier means the region is a gateway location, so treat it as unknown for anything finer than country. A hosting connection type or any of the VPN, proxy or Tor flags means the address is infrastructure, so the region is unknown, full stop. A relay flag means the operator published the region themselves, so use it. Whatever is left is a fixed consumer or business line, and its region is good enough to add rights with. Log the inputs to every decision, because the record of why a session was classified is the record you will defend an audit with.

If your legal team insists on keeping a geofence anyway, California's own regulation sets the floor. Section 7025(c)(2) says a business "shall not require a consumer to provide additional information beyond what is necessary to send the signal," which makes a residency challenge an offer, not a gate. Show the visitor that the signal was not applied, show what the lookup concluded, and let them correct it with one click. That is what OneTrust and Ketch committed to when Wyden's office asked, and it is the less restrictive of the two options the InfoLawGroup analysis of August 31 leaves a geofencing business. The other is to honor GPC nationwide.

Audit your consent platform before the guidance arrives

The vendors moved before the regulators did. Osano, Usercentrics and Transcend honor GPC from every address. Ketch honored it by default only for addresses in enforcing states and has agreed to ship a default-on rejection indicator with a way to assert residency. TrustArc is changing default configurations for clients in enforcing states. The full list of commitments is public, and each of them is a default a customer can still override.

So check yours. Open a Brave window from a mobile hotspot and confirm the "opt-out honored" state appears. Do it again through a commercial VPN exit in Nevada, then from a cloud instance in Virginia. Pull the geo rule out of your consent platform's configuration and read what it does when the region is empty, because "unknown" routed to the ignore branch is the most common way this goes wrong. Then compare /.well-known/gpc.json on your own domain against what the rule does. If the answer to any of those is "depends on the IP," you are running the configuration the letter describes, and ten attorneys general have just been asked to find you.

Ipregistry returns the region, connection type, carrier and separate VPN, proxy, Tor and relay flags that the scoring rule above runs on, enough to widen a visitor's rights with confidence and to know when you cannot. Measuring how much of your GPC traffic lands in the unknown bucket takes an afternoon and 20,000 free lookups to get started.