Source: I implemented part of the sanctions compliance for a major tech company’s platform (and saw other projects get sunset because they didn’t implement it)

Btw, doesn't blocking by IP address go beyond what is required by law, since only Iranian residents are subject to sanctions? Would preemptively restricting accounts that have logged in from an Iranian IP address and asking for proof of residence break the law?

The penalties for violating sanctions are so severe that it is worth the risk of potentially blocking legitimate customers.

> Would preemptively restricting accounts that have logged in from an Iranian IP address and asking for proof of residence break the law?

It would be extremely expensive and in a literal sense not worth the time.