Many governments are exploring geo blocking as a way to control access to online services. New Zealand has proposed a licensed online casino model that includes measures to prevent unlicensed offshore operators from serving New Zealand players.
Similar concepts also appear in major supply chain and trade environments. The European Union uses geo-based import controls for agricultural goods so only shipments registered from authorised regions can enter specific markets under sanitary and phytosanitary rules.
The United States Customs and Border Protection uses location linked manifests and Automated Commercial Environment filings to block entry of products from regions associated with forced labour. China’s cross border e commerce zone system restricts the flow of certain goods to approved geographic warehouses before they can enter domestic distribution channels.
Pharmaceutical supply chains in the European Union rely on the Falsified Medicines Directive which enforces regional serialisation and verification so medicines can only be dispensed within approved territories. These supply chain controls are intended to protect markets, manage risk and ensure provenance.
At first glance the idea of using location-based access controls to protect consumers and enforce law seems attractive. However, the technical and practical limits of geo-based blocking mean the policy may not work as intended.
What is geo blocking?
Geo blocking is a set of technical and operational measures that restrict access to online services based on the apparent geographic location of a user. Common aims include enforcing licensing territories, complying with local law and implementing commercial licensing rules.
In legal drafting a geo block is often presented as an enforceable tool where users physically located within a jurisdiction are permitted to access only licensed services.
In practice that locational gate is implemented using internet protocol level and application-level signals that attempt to infer geography. The specific methods matter for both effectiveness and privacy outcomes.
Many systems rely on large commercial geolocation databases that map internet protocol ranges to countries, but these mappings can be inaccurate or delayed when address blocks are reassigned.
Content delivery networks further complicate enforcement because traffic may be routed through servers in different regions which can distort the perceived location of a user.
Some regulators and platforms attempt to strengthen geo-based controls by combining internet protocol checks with device location data or payment address verification, yet these signals can also be spoofed or bypassed.
Governments that manage digital trade or media rights often use the same techniques, for example when streaming platforms limit access to region specific libraries, but these restrictions are routinely circumvented by virtual private networks or residential proxy networks.
As a result, geo blocking systems often operate as partial deterrents rather than complete barriers, and their reliability depends heavily on operational upkeep, data accuracy and the speed at which adversaries adapt.
In July 2025 the New Zealand government introduced an Online Casino Gambling Bill that would create a licensed market for online casinos and empower the Department of Internal Affairs to regulate operators and make unlicensed offshore operation and advertising unlawful.
The policy papers and the Regulatory Impact Statement outline the government objective of protecting players, channelling demand to licensed operators and reducing offshore advertising that targets New Zealanders. The minister who introduced the bill is the Minister of Internal Affairs Brooke van Velden.
Public submissions and industry groups have already debated the scope and enforcement approach.
Technical methods used for geo blocking
Regulators and operators use several technical methods to enforce geo-location controls, but each has significant limitations. The most common approach is IP-based filtering, where operators map IP address ranges to countries and allow or deny traffic accordingly.
This method is inherently fragile: IP allocations frequently change, cloud infrastructure can route traffic through unexpected regions, and users can mask their location with VPNs or proxy services. Blocking large cloud IP ranges often disrupts legitimate services, and maintaining accurate lists of VPN exit nodes is an ongoing cat-and-mouse process.
A second method is DNS-level blocking, where internet service providers redirect domain lookups so that offshore sites resolve to a warning page instead of their actual host.
These controls are easily bypassed through alternative or encrypted DNS resolvers or by connecting directly to an IP address. DNS-based blocking also risks collateral damage when legitimate services share infrastructure with blocked sites.
More advanced systems use transport-layer inspection or deep packet inspection (DPI) to identify undesirable traffic by analysing TLS server-name indications or protocol fingerprints. However, modern VPNs increasingly disguise or obfuscate their traffic patterns, reducing detection accuracy.
Implementing broad DPI-based controls requires infrastructure similar to general-purpose censorship systems, introduces significant privacy concerns, and remains partially vulnerable to adaptive evasion techniques. DPI is also expensive to operate and maintain.
Finally, some platforms rely on browser- or device-level checks, such as requesting geolocation API access, analysing device fingerprints, verifying payment addresses or SIM details, or using location-based multi-factor authentication.
These measures can be circumvented by users who deny geolocation requests, spoof device attributes, use international payment methods, or create accounts through address-verification services. Device-level checks raise privacy concerns and are readily evaded by privacy-focused browsers, making them effective only as partial deterrents.
Why geo blocking may fail in New Zealand’s new gambling law
Geo blocking may fail in New Zealand’s new gambling law because the policy framework depends partly on preventing access to unlicensed offshore sites while licensing up to 15 approved platforms and prohibiting unlicensed operation and advertising.
Although this appears straightforward, a large share of users already rely on VPNs, proxies and other circumvention tools to bypass regional restrictions for streaming and other online services.
Research consistently shows that these tools are widely available and frequently used, meaning simple location-based blocking would still leave a substantial group able to reach offshore operators.
This highlights a central point in the wider debate about why geo-blocking may fail, since the underlying technology was never designed to provide airtight jurisdictional enforcement.
Network level blocking through DNS or IP filtering can also disrupt legitimate services hosted on shared cloud providers and raises legal concerns about proportionality and freedom of expression.
When access restrictions are imposed, offshore operators typically respond by rotating IP addresses, using content distribution networks, standing up mirror domains and building mobile apps with private routing, all of which increase enforcement complexity and require continuous monitoring and international cooperation.
Even if these controls reduce casual access, motivated users who bypass restrictions may shift toward riskier unregulated channels where consumer protections are weaker, undermining the harm minimisation goals of the legislation.
Economic incentives further work against complete blocking because offshore operators and affiliate networks continue to profit from reaching New Zealand users, particularly through social and search platforms that are difficult to police fully.
Taken together, these technological and behavioural dynamics show why total prevention is unlikely and why geo blocking may not deliver the outcomes the policy intends.
Supply chain parallels and what regulators can learn
Geo blocking used as regulation has clear analogies to supply chain integrity work, and these parallels reveal lessons for policy and operations. In physical logistics, customs border checks reduce certain flows but never fully stop smuggling or diversion, just as geo location checks reduce casual access but cannot prevent determined users from reaching offshore services.
This is why effective supply chain integrity relies on layered controls that combine identification, trusted credentials, provenance information and continuous monitoring, and the same layered approach can strengthen digital market regulation.
Modern supply chain practice also emphasises provenance tracking and immutable records so items can be traced throughout their lifecycle, and regulators in digital markets can use similar methods by prioritising trusted identities for operators, strong licensing frameworks with auditable records, and payment channel controls that make unregulated services harder to monetise.
Just as logistics enforcement often succeeds by targeting transactional channels rather than blocking the physical movement of goods, regulation of online gambling can benefit from focusing on financial flows through payment processors, app stores and advertising platforms, which limits profitability even when access remains technically possible.
Supply chain programmes also depend on real time detection using sensor data and anomaly analytics, and digital regulators can adopt comparable techniques by leveraging telemetry from networks, advertising systems, payment tools and social media to identify affiliate networks and targeted promotions aimed at New Zealand users.
Combining these detection capabilities with targeted takedowns and proportionate civil penalties offers a more sustainable solution than relying solely on broad universal blocking.
Improving integrity without overly relying on geo blocking
Technical recommendations for improving integrity without overly relying on geo blocking focus on measures that reduce harm and limit monetisation pathways even when absolute blocking is unrealistic. Regulators can strengthen licensing by requiring operators to publish evidence of operational control and undergo regular independent audits, creating a transparent onshore alternative that users can trust.
Payment channel controls can then be used in cooperation with financial regulators and major banks to detect and block settlement flows linked to unlicensed operators, a method already shown to be effective in anti-money laundering programmes where suspicious transaction monitoring disrupts illicit activity.
Advertising and affiliate networks should also be key enforcement points because offshore platforms rely heavily on search and social media placements, and targeted penalties can significantly reduce customer acquisition.
Improved detection and analytics can be built by aggregating data from ad platforms, payment processors and network telemetry, similar to the integrated risk engines used in modern fraud detection systems that correlate signals to identify persistent threats.
Stronger identity verification requirements for licensed services help build a trustworthy market and reduce the attractiveness of unregulated channels, while targeted blocking of specific high-risk operators avoids the collateral harm caused by bulk DNS or cloud range blocking.
These approaches can be further strengthened by incorporating lessons from sectors such as counterfeit goods enforcement, where payment interdiction and coordinated platform reporting systems have proven more effective than purely perimeter-based controls.
Together these measures create a more resilient regulatory framework that does not depend solely on location-based restrictions.
Final thoughts
Geo blocking can be part of a regulatory toolkit, but it should not be the sole pillar of an enforcement strategy. New Zealand casinos reforms reflect a credible attempt to bring online casino operations into a regulated framework and to protect players.
At the same time the technical limits of geo blocking and the prevalence of circumvention tools mean regulators should not assume location-based blocking will be decisive.
The better path borrows supply chain thinking. Focus on provenance, on the financial and advertising channels that enable offshore operators, and on strong licensing with transparency and auditability.
Use detection and targeted enforcement rather than expecting perfect network level control. That approach reduces harms and improves resilience while acknowledging why geo blocking may fail in practice.
Article and permission to publish here provided by Rupert Walters. Originally written for Supply Chain Game Changer and published on November 24, 2025.
Cover image by Welcome to All ! ツ from Pixabay.