Privacy by architecture, not policy

IP geolocation built so
your application never needs
to send the full IP.

Send a partial prefix like 217.233.x.x and get country, ASN, and network back. The lookup API is designed around partial prefixes instead of exact IP input.

Under GDPR, IP addresses are personal data. Sending one to a third-party API is a regulated data transfer. BlurLoc is architected so the lookup provider does not need the exact IP: you send a coarse network prefix, not an individual host address. That changes what the provider receives, not just what your privacy policy says.

Try it free. No signup. See how it works
No API key No signup No credit card Free tier starts immediately
Every other IP geolocation API
Request
GET /lookup/217.233.224.23
Full IPv4 transmitted. Personal data under GDPR (ECJ ruling, 2016).
vs.
BlurLoc
Request
GET /lookup/217.233.x.x
The lookup payload is a coarse prefix. BlurLoc receives a network-level signal, not an individual host address.
Response: same result
"country_code": "DE",
"country_name": "Germany",
"asn": 3320,
"probability": 1

Why this matters legally

IP addresses are personal data

The ECJ confirmed in 2016 that IPv4 addresses, including dynamic ones, are personal data under EU law. GDPR Recital 30 names IP addresses explicitly. This is settled law, not interpretation.

Third-party API call = data transfer

Sending a full IP to an external geolocation API is a GDPR-regulated data transfer. It requires a legal basis, a signed Data Processing Agreement with the provider, and disclosure in your privacy policy.

BlurLoc: a different disclosure architecture

A prefix like 217.233.x.x identifies a network range, not an individual host. EU law assesses identifiability from the recipient's perspective. A coarse prefix covering 65,536 addresses does not single out a user in the same way a full IP can. Website visits and server logs need separate assessment.

How it works

Three steps. One HTTP call. The lookup provider receives a network prefix, not a user IP.

1

Trim the trailing octets

Truncate before sending: 217.233. or 217.233.x.x. The exact address never leaves your server. BlurLoc receives only a coarse network prefix, not an individual host address.

# user's exact IP (never leaves your server)
ip = "217.233.224.23"

# truncate before sending
prefix = "217.233."
2

Query the BlurLoc API

A plain HTTP GET with the prefix in the URL path. No API key required on the free tier. Works from any language or runtime: if it can make an HTTP request, it works.

curl -s "https://blurloc.com/lookup/217.233."
3

Receive location data

Get country, ASN, organization, hosting and VPN flags, and a probability score. Everything you need for routing, fraud signals, and regional decisions. The lookup provider never receives the full IP.

"country_code": "DE",
"asn": 3320,
"is_vpn": false,
"probability": 1

Try it now

No signup. No API key. Type any prefix and run a live lookup.

Try:
curl
curl -s "https://blurloc.com/lookup/217.233.x.x"
Response 
Run a lookup to see the JSON response.

Integrate now. It's free.

A plain HTTP GET. No SDK, no special client, no surprises.

OpenAPI AI integration guide
cURL
# Free tier, no key needed
curl -s \
  "https://blurloc.com/lookup/217.233."
const prefix = "217.233.";
const res = await fetch(
  `https://blurloc.com/lookup/${prefix}`
);
const { country_code, asn }
  = await res.json();
import requests

prefix = "217.233."
res = requests.get(f"https://blurloc.com/lookup/{prefix}")
data = res.json()
country_code = data["country_code"]
prefix := "217.233."
resp, _ := http.Get("https://blurloc.com/lookup/" + prefix)
defer resp.Body.Close()
var data map[string]any
json.NewDecoder(resp.Body).Decode(&data)
require "json"
require "net/http"

prefix = "217.233."
uri = URI("https://blurloc.com/lookup/#{prefix}")
data = JSON.parse(Net::HTTP.get(uri))
$prefix = "217.233.";
$json = file_get_contents("https://blurloc.com/lookup/" . $prefix);
$data = json_decode($json, true);
$countryCode = $data["country_code"];
String prefix = "217.233.";
HttpRequest request = HttpRequest.newBuilder()
  .uri(URI.create("https://blurloc.com/lookup/" + prefix))
  .build();
HttpResponse<String> response = client.send(request, BodyHandlers.ofString());
var prefix = "217.233.";
using var client = new HttpClient();
var json = await client.GetStringAsync(
  $"https://blurloc.com/lookup/{prefix}"
);
var data = JsonSerializer.Deserialize<Dictionary<string, object>>(json);
let prefix = "217.233.";
let data: serde_json::Value = reqwest::get(
  format!("https://blurloc.com/lookup/{}", prefix)
)
.await?
.json().await?;
Response 200 OK
{
  "api_version": "v1",
  "query": "217.233.x.x",
  "match_type": "exact",
  "country_code": "DE",
  "country_name": "Germany",
  "asn": 3320,
  "is_vpn": false,
  "network": "217.224.0.0/12",
  "probability": 1,
  "warning": null,
  "candidate_count": 1
}

Everything you need.
Nothing you shouldn't send.

Built for partial prefixes

Accepts wildcards like 217.233.x.x or 217.233.224.x. The design intent is prefix-only input. The lookup provider does not need the exact IP in the intended flow, and that is the point.

Strict mode on by default

Exact IP input is rejected with a 400 error by default. Prefix-only input is the canonical integration path. Pass ?strict=0 only if you intentionally need to accept full IPs for compatibility reasons.

Probability scores

Every result includes a confidence score based on IP address-space overlap with the matched network. Know how certain the result is, especially when querying with a wider prefix.

ASN + org data included

Every response includes the Autonomous System Number, organization name, and hosting/VPN flags. Enough to distinguish residential traffic from datacenter, proxy, or VPN users.

Zero-friction free tier

No signup, no account, no API key on the free tier. Open a terminal and start querying. When you outgrow the limits, upgrade with a single Stripe checkout. No sales call, no contract.

Simple, honest pricing

No surprise overages. No data harvesting. No vendor lock-in.

Free

$0 /month

For personal projects and evaluation.

Start for free
  • 10,000 requests / month
  • No API key required
  • Country, ASN & network
  • VPN & hosting detection
  • 60 requests / minute
  • Use in commercial products
Most popular

Pro

$14 /month

For production apps and growing teams.

Get started
  • 100,000 requests / month
  • API key included
  • Everything in Free
  • Strict mode enforcement
  • 300 requests / minute
  • Email support

Scale

$49 /month

For high-volume APIs and enterprise teams.

Get started
  • 1,000,000 requests / month
  • Everything in Pro
  • 1,000 requests / minute
  • 99.9% uptime SLA
  • Priority support
  • Custom DPA on request

All plans include full API access, VPN/hosting detection, and probability scoring. Need higher volume? Contact us.

Frequently asked questions

Does BlurLoc actually solve the GDPR problem?

The lookup API is designed so your application sends a coarse network prefix, not a full IP. That changes what the lookup provider actually receives. Identifiability under EU law is assessed from the recipient's perspective, using realistic means of attribution. A coarse prefix covering 65,536 addresses is a materially different input from a full host address.

Read the full reasoning →

How accurate is a partial prefix lookup?

For country-level and ASN-level resolution, accuracy is comparable to a full IP lookup. ISPs and carriers typically assign entire /16 or /24 blocks to a single country and autonomous system. BlurLoc also returns a probability score with every result so you always know how confident the match is. For routing, fraud signals, and regional decisions, partial prefixes are sufficient in the vast majority of real-world cases.

See why BlurLoc is accurate →

Do I need a DPA with BlurLoc?

No. In the intended prefix-only flow, the lookup payload does not constitute personal data from BlurLoc's perspective. A coarse network prefix does not single out an individual, and BlurLoc has no realistic means to link it to a specific person. Where the input is not personal data in the lookup provider's hands, the processing does not automatically trigger a DPA requirement.

If you disable strict mode and send full IPs, the standard personal-data analysis applies and a DPA would be appropriate. Website traffic and server logs remain ordinary personal-data processing and need separate assessment. Custom DPA available on the Scale plan.

Why BlurLoc is legally different →

What if I need to send a full IP?

By default, exact IP input is rejected with a 400 error. That is the intended behavior. Prefix-only input is the canonical integration path.

If you need to accept full IPs for compatibility reasons, pass ?strict=0 to disable strict mode. BlurLoc returns a result but flags the response with "warning": "exact_ip_submitted". Note: this is compatibility mode. Submitting a full IP restores full-IP transfer dynamics. The compliance and privacy advantage of the prefix-only flow does not apply.

What data fields does BlurLoc return?
Every response includes: country code and name, ASN and organization name, the matched network CIDR, hosting provider flag, VPN flag, match type (exact or probable), probability score, and candidate count. Add ?full=1 to receive the complete ranked list of candidate networks with individual probability scores.

Stop sending full IPs
to third parties.

BlurLoc gives you the location signals you need without requiring your application to send a full IP to the lookup API. Free to start. No signup. No credit card.

Try it now. It's free. See pricing

10,000 requests/month free. Upgrade anytime. Cancel anytime.