Reliability of IP Geolocation Services for Assessing the Compliance of International Data Transfers

The General Data Protection Regulation sets strict requirements to allow personal data transfers outside the European Economic Area. Thus, knowing the geographical destination of data transfers is becoming increasingly important for different stakeholders such as data controllers that may become data exporters or data protection authorities who need to assess data processing compliance. To this end, several online databases and services provide geolocation data for IP addresses with different accuracy and reliability levels. This paper analyzes ten different IP geolocation services to understand their reliability against known ground truth and applies them to further assess whether 767 Android apps indeed carry out international personal data transfers. Our results show great discrepancy depending on the service used, thus demonstrating the uncertainty data controllers and supervisory authorities face to assess these data flows.