95% is not acting ethically it’s documenting how you are in compliance in a way that will hold up to whatever regulating agency comes asking.

Doing that requires understanding a law with out much case precedent, that is extremely broad and has a whole spectrum of enforcement options.

I completely see why a small org might decide to just geo block. That’s an easy to implement, easy to document & defend attempt at compliance.