Geoblocking: EU Rules, U.S. Requirements, and Compliance

Geoblocking laws and compliance obligations pull in opposite directions depending on where your business and your customers sit. The European Union broadly prohibits unjustified geoblocking of goods and many services, U.S. sanctions law sometimes requires it, copyright licensing depends on it, and privacy law governs the location data every geoblocking system relies on. A workable compliance program has to answer all four pressures at once.

What the EU Prohibits

Regulation (EU) 2018/302 is the most developed law targeting unjustified geoblocking anywhere in the world. It prohibits traders operating within the EU from applying different terms of access to goods or services based on a customer’s nationality or place of residence.¹ Three categories of transactions fall inside its scope:

Physical goods where the trader doesn’t offer cross-border delivery. The trader still cannot block the sale. The customer must be allowed to buy and arrange pickup or their own shipping.
Electronically supplied services such as cloud storage, data warehousing, and website hosting. Prices and conditions cannot vary based on where the customer lives.
Services delivered at a physical location, such as hotel stays, car rentals, or event tickets. A trader cannot charge more or restrict access because of the customer’s home country.

A common misconception is that the regulation forces traders to ship everywhere. It does not. A French online furniture store has no obligation to deliver to Poland, but it cannot block a Polish customer from placing an order and hiring a courier to collect it in France.¹

Automatic redirection is a separate technical rule. Traders cannot redirect a customer to a different version of their website based on the customer’s location without explicit consent.¹ A Spanish customer landing on the German version of your site must be allowed to stay and browse. Suggesting a redirect is fine; forcing one is not.

Payment processing carries its own restriction. Traders cannot refuse or apply different conditions to a payment based on where the customer’s bank is located or where their card was issued, as long as the payment method is one the trader already accepts.¹ You don’t have to accept every payment brand, but the ones you do accept must work identically across the EU.

Enforcement happens at the national level. The regulation requires each Member State to set penalties that are “effective, proportionate and dissuasive” without prescribing a specific fine amount, so the financial exposure depends on which national authority takes action.¹

Sectors the EU Regulation Doesn’t Cover

Several industries sit outside the regulation. The most commercially significant exemption is audiovisual services. Streaming platforms, live sports broadcasts, and video-on-demand can keep regional content libraries and geographic blackouts without breaching the rule.¹ Financial services (banking and insurance) and healthcare and social services are also exempt, on the reasoning that these fields already operate under their own regulatory frameworks.

The European Commission has reviewed whether to expand the scope to copyrighted digital content such as e-books, music, software, and online games, along with transport and audiovisual services.² No expansion has been enacted so far, but the exemption is not permanent.

When U.S. Law Requires Geoblocking

The United States has no general prohibition against geoblocking. In some situations it requires it. The Office of Foreign Assets Control (OFAC) administers sanctions programs prohibiting U.S. persons and companies from transacting with individuals, entities, or entire countries on sanctions lists. Online businesses must ensure they are not providing goods, services, or access to users in comprehensively sanctioned jurisdictions or to Specially Designated Nationals.³

OFAC has acknowledged that IP address blocking is a common compliance tool for internet-based businesses, while noting that it is not foolproof because geographic assignments of IP ranges change. Companies relying solely on IP blocking may not fully address their compliance risks. OFAC penalties can reach into the millions of dollars per violation, so in the sanctions context under-blocking is far riskier than over-blocking.

Copyright Licensing and Cross-Border Portability

Copyright law works on territoriality. A rightsholder can license content to different distributors in different countries: a film studio might sell exclusive streaming rights in Germany to one platform and exclusive rights in Spain to another. Geoblocking is the mechanism that makes this licensing model work. Licensing fees are calculated around those boundaries, and courts have generally treated territorial licensing as a legitimate exercise of intellectual property rights.

The EU has partially softened this for travelers. Regulation (EU) 2017/1128 requires paid online content services to let subscribers access their existing libraries when temporarily in another EU country, without extra charges.⁴ A German Netflix subscriber in Italy sees the German library, not the Italian one, because the service is treated as being provided in the subscriber’s home country. The rule applies to paid services; free-service providers can opt in but are not required to. Territorial licensing itself remains intact.

Privacy Rules That Govern the Location Data

Every geoblocking system depends on knowing where the user is, so privacy law reaches into the mechanism itself. Under the GDPR, IP addresses qualify as personal data because they can identify or help identify an individual. Collecting them requires a lawful basis under Article 6. For geoblocking, the bases most commonly invoked are legitimate interest and legal obligation, the latter where a law such as a sanctions regime requires the restriction.

The GDPR’s data minimization principle limits collection to what the geoblocking function actually needs. Grabbing precise GPS coordinates when a country-level IP lookup would suffice creates avoidable exposure. Businesses must also give clear privacy notices explaining that location data is being collected, why, and how it affects the user’s experience. Violations of core processing principles can result in fines up to €20 million or 4% of worldwide annual turnover, whichever is higher.⁵

California and Other U.S. State Privacy Laws

In the U.S., California’s Consumer Privacy Act (as amended by the CPRA) classifies precise geolocation as “sensitive personal information.” Consumers have the right to direct a business to limit use of that information to what is necessary to provide the goods or services they requested.⁶ Businesses must provide a “notice at collection” before or at the point of data collection, listing the categories gathered and the purposes.⁷ Several other states have adopted similar frameworks. Even a basic IP-based location check can trigger notice and opt-out requirements under state law, not only under the GDPR.

Building a Compliance Program

Five practical steps hold most programs together:

Screen against sanctions lists. Use IP-based screening and add verification for transactions involving high-risk jurisdictions. OFAC compliance is not optional for U.S.-connected businesses.
Audit redirection scripts. Any geographic redirection on an EU-facing site must be consent-based, not automatic. Log the consent.
Review payment gateway settings. Confirm your processor is not filtering by IP address or card-issuing country in ways that violate the EU payment rule.
Minimize location data collection. If country-level identification is enough, don’t collect precise coordinates.
Publish clear privacy notices. GDPR and California law both require disclosure of what location data you collect, why, and what rights users have. Build the disclosures into your cookie consent flow and privacy policy.

The hardest part of compliance is that the regimes point in different directions. EU trade law says stop blocking. OFAC says you must block. Copyright licensing says blocking is contractually required. Privacy law says minimize the data used to do any of it. A workable program satisfies each pressure within its own domain rather than trying to reconcile them into a single rule.

Risks for Users Who Bypass Geoblocks

Users who circumvent geographic restrictions with VPNs or proxies face a layered set of risks, though prosecution is uncommon. Contractual exposure is the most immediate: streaming services such as Netflix prohibit circumvention in their terms of use and reserve the right to terminate accounts, though in practice they tend to block the VPN connection rather than close the account.

Copyright law raises a more serious question. In the U.S., the Digital Millennium Copyright Act prohibits circumventing technological measures that effectively control access to copyrighted works.⁸ Statutory damages for circumvention range from $200 to $2,500 per act.⁹ Whether geoblocking consistently qualifies as such a measure is unsettled, and courts have not broadly tested the theory.

Using a VPN to make it appear that a user is accessing a service from a non-sanctioned country while actually located in a sanctioned jurisdiction is sanctions evasion, with penalties far more severe than any copyright claim.

1
EUR-Lex. Regulation (EU) 2018/302 – On Addressing Unjustified Geo-blocking and Other Forms of Discrimination
2
European Commission. Geo-blocking – Shaping Europe’s Digital Future
3
U.S. Department of the Treasury. OFAC FAQ 73
4
WIPO. Regulation (EU) 2017/1128 – Cross-border Portability of Online Content Services
5
GDPR.eu. Art. 83 GDPR – General Conditions for Imposing Administrative Fines
6
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.121
7
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
8
Office of the Law Revision Counsel. 17 U.S. Code 1201 – Circumvention of Copyright Protection Systems
9
Office of the Law Revision Counsel. 17 U.S. Code 1203 – Civil Remedies