And how on Earth is this rule enforced? I'm genuinely curious. Even if it's something like asking for SSN if IP addresses s from US, it would be bypassed easily by a simple proxy.