You need a legal basis for automated decision-making, such as doing geolocation on a user's IP address (which can be considered PII, as per EU legal rulings from last year). Which means you cannot block them without first getting that legal basis (i.e. consent). Therefore, you're in a catch 22.