Utah passed a law that requires adult sites to know whether a user is physically in Utah. VPN or not. Pornhub's parent company, Aylo, filed a lawsuit saying that the law asks the impossible. That there is no way to really know where a device is. But that isn't true. A VPN moves your traffic. It doesn't move you. Age verification is a location problem at its core. If regulated companies want to avoid verifying the age of their entire user base, they will find a way to move on from broken and antiquated geofencing practices. Our comment ↓

We looked up the "location" of an IP address to write this post. Used four different geolocation services. DB-IP said Toronto. IP2Location and ipwho.is said San Francisco. MaxMind returned "United States" with no city at all, and a very precise-looking coordinate that appears to be a field in Kansas. The furthest two are 3,644 km apart. This kind of divergence is the norm: IP databases disagree on the same address by 620 km on average. The IP address belongs to @Cloudflare. Since August 27 they have had an incident open: the commercial databases that turn IP addresses into location are returning the wrong country for WARP users. Cloudflare can't fix it, because it doesn't own those databases. That's MaxMind, IP2Location, Digital Element. Not one of them can see where you are. They infer it. Cloudflare's documentation is direct: "IP geolocation is an estimate, not an exact science. There is nothing that inherently binds an IP address to a physical location or country." Payment platforms, exchanges and licensed markets use that estimate as the signal. A user opens your app from a jurisdiction you're not licensed to serve. The lookup places them somewhere you are. You let them trade. Months later a regulator asks where that user actually was, and your evidence is a database reading that has since been corrected. Sanctions breaches are strict liability. A phone can settle it directly. Is this device inside this region, right now. Signed by a key that never leaves the chip. Verifiable offline. No coordinates leave the device. The location check doesn't have to be a guess.

Better doesn't mean blocking more people. It means letting the right ones through. Our best users hit a VPN block and go to a competitor. — Ecosystem lead, L2 network

Your "US persons only" control is probably a sentence in a policy document.

Someone on your payroll is probably not where your records say they are.

Su geobloqueo probablemente se ejecutó una vez, al registrarse. Compruebe cuándo fue la última.

Your geofence probably ran once, at signup. Check when it last ran.

La presencia simulada probablemente está ocurriendo en su plantilla, ahora mismo.

Simulated presence is likely happening with your workforce, right now. Nobody logged where they were, either.

Geofencing vendors treat a VPN as an attack. So the block lands on your customers who care about privacy and security. They get challenged, or told to turn something off before they can transact.

the ground truth problem