The EU Geo-Blocking Regulation ( Regulation (EU) 2018/302 ) doesn't care whether you block EU shoppers with a firewall rule, a redirect or a postcode validator. All three count. The third is the one most teams still ship without noticing.

The twist arrived in July 2026. In a case involving a work that was public domain in some member states but still protected in another, the EU's top court held that the publisher needed effective technological measures to exclude users in the protected territory. State-of-the-art IP geo-blocking can qualify even though some users can circumvent it with a VPN. Same lookup, opposite legal answer. What separates them is the reason behind the check.

Heads up: this is a developer's reading of the regulation and the Commission's own guidance, with links to both. It isn't legal advice.

TL;DR

Article 3 (page access): you can't block or auto-redirect EU customers by IP address.…