Country-Level Geolocation Is a Vendor Claim. Your Territory Clause Reads Like a Guarantee.

A territory-limited game licence is easy to sign and hard to enforce on the web. Country-level IP geolocation is a vendor claim, not a real compliance control. EU rules also prohibit the two simplest ways to shut a foreign visitor out. Most licensees discover this after signing, when someone finally asks who is building the gate and what happens when it is wrong.

🗺️ "Territory: Germany" Is a Sentence, Not a Mechanism

Territory clauses come from a world of shipping containers and retail shelves. A pallet of boxed games either crossed a border or it didn't. That is checkable. A games portal is a URL, and a URL is reachable from everywhere by default — the restriction is not something you fail to do, it is something you have to actively build.

Nobody in the negotiation owns that build. The licensor's counsel writes the scope. The licensee's commercial lead reads the price. The engineer who will eventually have to implement country gating is not on the call, and by the time they are, the standard in the contract is already absolute: the licensee shall not make the licensed titles available outside the Territory.

Shall not. Not "shall take reasonable steps to prevent." That distinction is the whole post.

Read your own clause and answer three questions before you worry about anything else. What counts as making a game available — serving the file, listing it in search, or actively marketing it? Who decides which country a given player is in? And if the answer is wrong, is that a breach, or a fact of the internet that both parties agreed to live with?

📍 Vendors Publish 99%. An Independent 2026 Study Measured Distance Instead.

Geolocation providers are confident about country. ipgeolocation.io's 2026 guide reports 99%+ country-level accuracy, 90%+ at region level and 85%+ at city level, measured across its own dataset. Other commercial providers publish figures in the same band. Every one of those numbers is a vendor self-report on its own data, which is not the same thing as an audit.

An independent comparison ran alongside it. ipapi.is collected ground-truth GPS coordinates from browser visitors between 22 January and 15 June 2026 and compared them against ten major geolocation APIs. The findings are distance-based rather than country-based, and they are sobering:

• Metropolitan-area accuracy, within 50 km: roughly 50% to 75% depending on provider.
• City-level accuracy, within 10 km: roughly 15% to 35%.
• 75th-percentile deviation: 128 to 288 km.

Those are the good conditions. The study deliberately filtered out datacentres, VPNs, proxies, Tor and satellite connections before measuring, on the grounds that including them makes the comparison meaningless. So this is best-case residential traffic, and a quarter of it still lands more than 128 km from the player.

A 128 km error does not matter for ad targeting. It matters enormously in Europe, where 128 km from Aachen is a different country, and in the Gulf, and across Southeast Asia, and anywhere your territory line runs closer to your users than your error bars do.

The failure modes that specifically break a territory clause

The ipapi.is study names where the worst errors come from, and each one describes a large slice of a casual games audience:

• Mobile carrier IPs. Carriers route traffic through regional gateways, and databases frequently resolve the address to the operator's registered location rather than the subscriber's. The study reports maximum deviations above 15,000 km from this cause alone.
• CGNAT. As IPv4 exhaustion pushes more subscribers behind carrier-grade NAT, the address you see belongs to the gateway shared by a wide area, not to a person.
• IPv6. Databases hold less historical data for IPv6 blocks, and accuracy still trails IPv4 in some regions.

Mobile, CGNAT and IPv6. That is not a rounding error at the edge of your traffic — for a mobile-first web portal in an emerging market, it is close to the whole audience.

And then there is the deliberate case

Some share of your players are actively defeating the gate. The size of that share is genuinely disputed, and it is worth saying so rather than picking the convenient number. Security.org's VPN research, last updated 18 March 2026, found 46% of surveyed Americans using a VPN, with Indonesia at 55%, India at 43%, and the UAE, Thailand and Malaysia at 38% each. Traffic-based estimates land much lower — around 23% of global internet users in mid-2025 by Surfshark's count. Survey self-reports and network measurement are answering different questions, and the honest planning range is wide: somewhere between a fifth and a half of your users, depending on market.

One number in the Security.org data is pointed at you directly: 57% of mobile VPN users said they use it to get at better TV, movies and games. Circumventing content geo-restriction is not an incidental side effect of VPN adoption. For a meaningful chunk of users, it is the reason they installed one.

🚫 EU Law Bans the Two Simplest Implementations

Having accepted that your gate leaks, the instinct is to build a heavier one: detect the country, and if it's outside the territory, refuse to load the site or bounce the visitor to a local version. Both of those are specifically restricted in the EU, and the rule has been in force since December 2018.

Under Regulation (EU) 2018/302 on unjustified geo-blocking, the position for games splits in a way that is easy to get backwards:

• Article 4(1)(b) works in your favour. Services whose main feature is providing access to copyright-protected works — and online and downloadable games are named in the guidance on this — are carved out of the ban on applying different general conditions of access by country. You are allowed to serve different content, and different terms, to customers in different member states.
• Article 3 does not. The prohibition on blocking or limiting access to your online interface for reasons of nationality, residence or establishment applies regardless. So does the ban on automatically redirecting a visitor to a different version of your site without their express consent, and on discriminating on payment conditions.

The practical translation is short. Gate the game, not the site. A visitor from outside the territory must be able to reach your portal, browse it and see what it is. What they may not be able to do is play that particular licensed title. No country splash wall in front of the whole domain. No silent redirect from the .com to the local domain — offer it, let them choose, and keep the original reachable.

This is a summary of a regulation, not advice on your situation, and the carve-out is narrower than a quick read suggests. If your portal takes payment, the payment-discrimination rules bite whatever the content exemption says. Put it in front of counsel before you build.

⚖️ Competition Law Is the Larger Risk

The geo-blocking regulation carries consumer-law consequences. Competition law carries bigger ones, and the games industry has a directly relevant precedent.

In January 2021 the European Commission fined Valve and five publishers over territorial control functionality applied to Steam activation keys, which restricted cross-border sales of certain PC games — concentrated in the Baltics and central and eastern Europe, between 2010 and 2015. Valve appealed. On 27 September 2023 the General Court dismissed the appeal and the €1.6 million fine stood. The Court rejected the argument that copyright ownership entitles a rightsholder to maintain different prices in different national markets.

That judgment does not make territory clauses illegal. It draws a line that matters when you are negotiating one. A territorial restriction that exists because the licensor genuinely does not hold the rights in a market is an entirely different thing from a territorial restriction that exists to keep prices apart inside the single market. When a licensor asks you to enforce a territory line inside the EEA, it is a fair question to ask which of the two you are enforcing — and to want the answer written down.

📱 App Stores Hand You a Country Switch the Web Doesn't Have

Here is the asymmetry most licensees never plan around. On Android, territory control is a platform feature. Google Play Console exposes a Countries/regions tab on the Production page: you add or remove markets, and the selection applies to current and future releases. Some countries carry additional regulatory requirements you have to satisfy before you can distribute there at all.

That is a real, auditable distribution boundary maintained by someone other than you. It binds where the app can be listed and installed, which is exactly what a licence usually means by "distribute."

Your web portal has nothing equivalent. There is no switch. There is only whatever you build on top of a geolocation lookup that a quarter of your traffic will defeat by accident and some further share by intention.

The operational conclusion runs against instinct: where a licence is genuinely territory-restricted and the exposure is material, the Android build is the safer surface and the HTML5 build is the risky one. Web is usually the easy, cheap, fast channel. On tightly territorial rights it is the one carrying the compliance weight. Plan the rollout accordingly rather than shipping web first out of habit.

✍️ Fix the Clause, Not the Code

No amount of engineering closes a gap this size, so stop trying to close it in code and go back to the paper. Six asks, roughly in order of how much they are worth:

1. Change the standard. Move from "shall not make available outside the Territory" to "shall employ commercially reasonable geographic access controls," then define what those are. A named commercial IP database, applied at the point the game loads, refreshed on a stated cadence. Now you have an obligation you can actually discharge.
2. Define the trigger. Distribution, active marketing, and passive accessibility are three different things. A player who arrives through a VPN you could not detect should not be a breach event. Say so explicitly.
3. Name the database. If you and the licensor consult different vendors, you will eventually disagree about the same IP address, and you will disagree during a dispute rather than before one. One named source of truth, written into the agreement.
4. Split sanctions from commerce. Embargoed and sanctioned territories are a legal obligation with a strict standard and serious consequences. Commercial carve-outs — a market the licensor sold to someone else — are a business term. They do not belong in the same sentence and should not share a remedy.
5. Prefer a short exclusion list to a short inclusion list. "Worldwide except China, Russia and sanctioned territories" is far cheaper to police than "Germany, Austria and Switzerland only," because the default posture is serve rather than block, and the errors fall on the safe side.
6. Ask for reversion on unexploited territories. If you take a wide grant, expect the licensor to want rights back in markets you never launch in. Agree the trigger and the notice period up front; it is a reasonable ask and conceding it early buys goodwill on the clauses that cost you real money.

One more, cheap to add and awkward to omit: agree what happens to a territory that is later withdrawn. Removal from a store is not instant, cached web builds persist, and the licence should describe a wind-down window rather than assume a switch.

🎮 Where This Sits in a Catalogue Deal

Forestry Games has licensed games since 2017 and maintains a catalogue of 1,049 HTML5 and Android titles, with terms set out on the licence and pricing page and the titles themselves in the catalogue. The territory question lands differently across a catalogue than it does on a single title, and it is worth asking about in the right shape.

On original titles, wide territory is usually straightforward — there is no upstream rightsholder imposing a line. Where a title carries third-party character IP, territory tends to be tighter, because the underlying character licence is itself territorial and no licensor can grant more than it holds. That is a general feature of branded IP, not a comment on any particular arrangement. The practical consequence for a buyer is the same either way: get territory scope in writing per title or per pack, not as one sentence covering a catalogue of a thousand games with different provenance behind them.

🧭 Before You Sign the Next One

Pull the last territory-limited licence you signed and find the enforcement standard. If it says "shall not make available" with no qualifier, you are carrying an absolute obligation against a control that measures accuracy in hundreds of kilometres and loses somewhere between a fifth and half your users to VPNs. That is not a gap you can engineer away, and the licensor almost certainly did not intend to create it — the clause was inherited from a template, not designed for your product.

Send one email asking to amend the standard to commercially reasonable efforts, with the mechanism named. Most licensors say yes, because the alternative is a licensee who quietly breaches from day one. Do it before the renewal, when you have leverage and nobody is annoyed yet.

Then, on the next deal, price the territory line honestly. A restricted territory is not just a smaller market — it is an engineering task, a legal review, and a residual liability that a worldwide grant does not carry. Sometimes the wider licence is cheaper than the narrow one once you count what enforcing the narrow one actually costs.