Q: For geo-compliance, should I trust IP geolocation or billing-address country?

Q: For geo-compliance, should I trust IP geolocation or billing-address country?

A: They answer different questions, and mixing them up is how you accidentally serve a restricted market.

IP geolocation tells you where the user is right now. It's instant and good for serving the right offer and language, but it's trivially shifted with a VPN or proxy — so it answers 'where is this connection,' not 'who is this person.'

Billing-address (or KYC document) country tells you where the user is established — the legally meaningful answer for licensing, tax, and restricted-market rules. Harder to fake, but you only get it deep in the funnel, often after payment.

When each rules:
— Content, language, and offer targeting up front: IP geo is fine.
— Regulatory gating (gambling, finance, age-restricted): billing/KYC country is the source of truth. IP is only a first-pass screen.
— The dangerous gap: IP says allowed country, billing says restricted. Always let the stricter signal win, and flag the mismatch — VPN-masking a restricted user is a classic compliance breach.

Short version: IP geo for targeting, billing/KYC country for regulatory compliance. When they disagree, the stricter one wins and the mismatch gets flagged.

Still stuck? Drop your case in the comments.