Wondering why anyone is still using ip-based geolocation. The most popular use for VPN's is mocking your location to Steam and Netflix. Could be these players allow mock locations because it gives them revenue..
- Content providers care because they want to sell exclusive per-region licenses.
- Netflix doesn't really care, in fact the may benefit from more content available to their users.
The end result is that Netflix will do the bare minimum to keep the content providers satisfied.
Steam is more of a concern because they have different prices per region. But IIRC they use your billing address, not your IP location which is harder to spoof.
Geolocation is largely a feature in products and in licensing because there is big purchasing power difference between rich and poor countries.
Netflix has been more tolerant in the past of region bypass than others for the same reason they didn't crackdown on password sharing but won't be in the future.
[1] The actual prices we pay might vary in both countries depending on promotion and tie ups etc, but these are list prices of which those components would be applied.
There are myriad ways of buying a subscription, including gift cards, third party tie-ups etc, it won't be easy to implement a fool proof solution which works for all of them, especially without degrading user experience.
It is more likely that problem is not big enough for Netflix that it wasn't worth investing that kind of effort.
Similar to how they are handling password sharing now, it is perhaps possible they will look into this in the future as margins tighten and pressure increases as they keep loosing subscribers to competition.
Why geo ip? Naivety/ignorance coupled with the outdated business logic that segmenting audiences to skim customers to the max will continue to be the winning strategy. It rarely come from within IT brainstorming, those in denial or sticking to short sighted green are the business strategists also being vaguely sold that controlling can be done (and to some degree yes it can be so long as consumers bases don't in their majority adopt privacy measures and moan when being unlegitimately denied access) On the more forgiving side, it does help easily monitor kiddy attacks altogether, if there is no market in Takjistan, why bother looking at false vs true positives coming from there, dumb scripts are dumb but can still be costly for the network management team.
I don't think there's a reasonable alternative. If you ask users for their location they can just lie, if you use the JS geolocation API they can trivially deny or spoof it. If you base it on billing address you're locking out people who are traveling, which seems unwanted (especially for long-term travel).
So instead they end up playing a cat and mouse game to try to block VPNs.