How to protect your geolocation when behind a VPN

ai-guapo
3 min readNov 29, 2023

--

One important step you can take in obfuscating your online digital identity is by implementing a VPN. A VPN together with browsing in incognito mode will help obfuscate your identity by not saving cookies, history and site data, in effect making it harder to track you online.

Unfortunately, a lot of VPN users are unaware that even though a VPN can hide an IP address, it seldom hides the geolocation of the actual browser. The JavaScript API of the browser allows a site to request location information, even behind a VPN. While most users are safe if they simple avoid pressing “allow” when a site requests your location (or blocking it altogether), some site require you reveal your location in order to access some resources.

Use Case

Let’s say you have a subscription to a VPN and download the extension or app. This will only hide your IP location from websites. You can further protect your browsing activities from websites by spoofing your geolocation. Why? Because some sites require you to reveal your location and because you can trick a site into providing services only available to certain regions. This is especially useful for dissidents that use a VPN to access banned information. The VPN would allow the dissident to access the information, but the browser’s geolocation would expose the user, making it easy to track the VPN back to the user’s physical location! Of course there is always TOR, but even that poses its own risk.

Here’s a test to discover if your geolocation is masked. *make sure your VPN is on and active in your browser.

Step 1: Visit https://iplocation.io/my-location
Step 2: Allow access to your location (you can remove it later in your browser settings).

*If you don’t see a popup requesting access to your location you have location request blocked on your browser, you must enable it first before performing this test.

What were the results? If you are like most your geolocation reveals a close approximation of your actual location, while your IP address location is the location of your VPN server. The problem is that it’s too easy for a site to guess which one is your VPN location and which one is your actual location.

Here is another test. If you are on Chrome/Edge download the following extension.

https://chromewebstore.google.com/detail/spoof-geolocation/ihdobppgelceaoeojmhpmbnaljhhmhlc

There are a number of geolocation spoofing apps in the Microsoft Edge Add-ons store, Chrome Web Store and Fire Fox Addons store. I chose this particular app because it is a featured app, and thus “Follows recommended practices for Chrome extensions”. But you are free to pick any geolocation spoofing app you like.

After you have the ‘Spoof Geolocation’ extension installed, enable it and right click on the icon and select Options/Randomize/0.1. This will enable a random geolocation after you set your initial spoofed location.

Now visit https://iplocation.io/my-location again while behind your VPN, and notice that this time your IP address’ location and geolocation are now both obfuscated. It would be hard for a site (but not impossible) to know where the user is physically located.

As for Android device users, there are plenty of geolocation spoofing apps in the Google Play store. Most will require that you enable developer mode first before you are able to use the app.

To enable developer mode follow these instructions. *instructions vary by device, so keep that in mind.

https://www.samsung.com/uk/support/mobile-devices/how-do-i-turn-on-the-developer-options-menu-on-my-samsung-galaxy-device/

Afterwards you can proceed to install a geolocation app. Geolocation spoofing apps can be found here:

https://play.google.com/store/search?q=gps+spoofing&c=apps

The above information is provided for educational purposes only, and is in no way advocating spoofing your location to commit crimes or thief of service. Refer to the terms and conditions of the service you wish to use to verify if spoofing your geolocation violates the terms. Furthermore, check your local and country laws.

--

--