Why do apps still rely on IP blocking when VPNs get around it?

Last reviewed 20 October 2026

Because IP blocking is the one location check that needs nothing from the user: no install, no permission prompt, no lost sign-ups, and it works on any website, so many gaming, prediction market and trading apps accept that it misses VPN users in exchange for not slowing everyone else down.

The reasons are practical

• No friction. An IP lookup happens on the server. The user sees nothing, so no one abandons sign-up at a permission prompt or a plugin download.
• It works everywhere. Web, desktop and mobile all send an IP address. A device check needs an app, or a browser permission, or both.
• It is the control regulators named. OFAC’s enforcement releases point to IP blocking as the baseline control, and faulted a company for not applying it to transactions (OFAC, Kraken). Meeting the named control can look like meeting the rule.
• Most people do not try. Most people outside a permitted region never try to get in, so a simple block handles most of the traffic.
• It was there first. Geoblocking was built into content delivery networks and firewalls long before location became a compliance question, so it is already switched on.

Where that stops being enough

Where location carries legal weight, the people trying to get in are motivated. A VPN costs a few dollars a month, and residential-IP services make traffic look like it comes from an ordinary home. See VPN, proxy, residential IP and Private Relay.

Courts are starting to say so. In August 2026 a Washington court ordered Kalshi to add an IP and residency geofence and then a “multi-source geofencing solution,” after the state showed that investigators in Nevada had placed trades “despite IP- and residency-based blocks” (Washington Attorney General, KUOW). See prediction market geofencing.

What changes the trade-off

The reason to keep IP blocking is that it costs the honest user nothing. A device check that also costs the honest user nothing removes that reason. When the check runs passively inside the app the user already has, with no plugin and no extra prompt beyond the location permission, there is no conversion cost to weigh against the VPN problem. See IP vs device geolocation and in-process geolocation.