Geo-Blocking Without Blocking Your Customers

# Geo-Blocking Without Blocking Your Customers

Geo-blocking fails in two directions: it lets determined evaders through and it stops legitimate travellers. Both are avoidable with a layered design.

Separate the three reasons you block

• Licensing. Content rights are territorial. You need a defensible country decision, and you must treat VPN exits as unknown rather than as their exit country.
• Sanctions and compliance. This is a legal obligation with an audit trail. Log the inputs to every decision.
• Abuse. Country is a weak abuse signal by itself. Classification and risk score carry the weight.

Conflating them produces rules nobody can explain six months later.

The layered rule

if classification in (tor, hosting, vpn) -> location is untrusted, apply policy for unknown else if country in blocked_list -> deny with a clear message else if risk_score > threshold -> challenge, do not deny else -> allow

The key move is treating anonymised traffic as unknown location, not as the country the exit node sits in. Otherwise a user in a restricted market simply picks a permitted exit and walks through.

Write the error message like a human

"This content is not available in your region" with a support link converts frustration into a ticket you can resolve. A blank 403 converts it into a chargeback and a bad review.

Handle travellers explicitly

A long-standing account that suddenly appears from another country is usually a holiday, not a takeover. Weight account history above the current IP: step up authentication rather than denying, and remember the outcome so the same trip does not trigger the rule daily.

Audit what you decided

Store the decision and the inputs that produced it (country, classification, risk score, rule id) rather than the raw lookup. You get an audit trail, a way to tune thresholds, and no growing pile of location data about your users.

Review the list quarterly

Block lists rot. Markets open, licences change, and a rule added for one campaign quietly costs revenue for years. Put the review in the calendar.