Yes, you need a commitment. The commitment comes from anyone who is trusted by the verifier to commit to genuine data. So to prove age, the date of birth, say seconds from epoch could come from a government issued ID. In case of lat-long, a location provider trusted by the verifier should be used so if verifier trusts Google. There is vast literature and implementations and they provide varying guarantees like if you provide a proof to the same verifier twice but use the same commitment, the verifier will know that he has interacted with you before or not. Depends if you care about this or not. Regarding how they work, there are several techniques, a recent and popular is Bulletproofs. Another is this paper.

Yes, you need a commitment. The commitment comes from anyone who is trusted by the verifier to commit to genuine data. So to prove age, the date of birth, say seconds from epoch could come from a government issued ID. In case of lat-long, a location provider trusted by the verifier should be used so if verifier trusts Google. 

There is vast literature and implementations and they provide varying guarantees like if you provide a proof to the same verifier twice but use the same commitment, the verifier will know that he has interacted with you before or not. Depends if you care about this or not. Regarding how they work, there are several techniques, a recent and popular is Bulletproofs. Another is this paper.