And to add one to your simple question: What if you run a service where you don't know where users are from? (Facebook knows a lot! It's a terrible example in this context.)

The best answer we got from the lawyers was "geo-ip". Alas, given that it has both plenty of false-positives and false-negatives (and people travel), it might as well mean violating privacy laws in both Russia and whichever-other-country.

Good times were had.