Are Geo-Redirects Legal in the EU? Regulation 2018/302

You sell into six EU countries. You have a German store, a French store and a catch-all English one. Someone on the growth team asks the obvious question: instead of three links in the campaign, why not one link that sends each visitor to their own country's store? Every geo-redirect tool sells exactly that, and you can ship it before lunch.

Here is the part the tool vendors leave out. Inside the EU, that redirect is regulated by consumer law. Regulation (EU) 2018/302, the Geo-blocking Regulation, has applied since 3 December 2018, and Article 3 covers exactly this behaviour: blocking access, and moving people to a different country version of your interface. Doing the second silently is prohibited. Not risky, not frowned upon. Prohibited, with national enforcement bodies behind it.

What the Regulation calls your link

Article 2(16) defines an online interface as any software, including a website or a part of one and applications, including mobile applications, operated by or on behalf of a trader to give customers access to its goods or services with a view to a transaction. Article 3(1) bites on conduct carried out "through the use of technological measures or otherwise", and Recital 18 names tracking a customer's location by IP address as exactly such a measure. The Commission services' own Questions and Answers on the Geo-blocking Regulation, last updated 8 March 2021, goes one step further: a trader may not reroute customers without their explicit consent on the basis of criteria related to nationality, residence or establishment, "including indirect criteria such as the IP address or the customer's payment details" (question 2.1.18). That is exactly the criterion a country-routed link runs on. Article 3(2), the redirection rule, names no mechanism at all: it asks only where the customer ended up. The Regulation never mentions links, because in 2018 nobody was writing rules for one. The conduct it describes is exactly what your link does.

Where privacy law stops and consumer law starts

Most articles about geo-redirects talk about the IP address, which is a separate, data-protection question. That half is covered: see the GDPR note in geo-targeted links versus plain redirects. This page is about the half almost nobody covers: whether you may move an EU shopper to another storefront at all, and what you owe them when you do. Verified against the text on 10 September 2026.

Tap to enlarge

Article 3 is short, which is why it gets misquoted: two distinct prohibitions and one carve-out, routinely collapsed into "geo-blocking is banned". Paragraph 1 is the rule most people know: a trader "shall not, through the use of technological measures or otherwise, block or limit a customer's access to the trader's online interface for reasons related to the customer's nationality, place of residence or place of establishment." Recital 19 extends its spirit to interfaces designed so that customers from other member states cannot easily complete an order.

Tap to enlarge

Paragraph 2: you may not redirect without explicit consent

A trader shall not, for reasons related to nationality, residence or establishment, "redirect that customer to a version of the trader's online interface that is different from the online interface to which the customer initially sought access, by virtue of its layout, use of language or other characteristics that make it specific to customers with a particular nationality, place of residence or place of establishment, unless the customer has explicitly consented to such redirection."

Three things follow. Running country-specific versions stays perfectly legal, and Recitals 20 and 27 say so in terms. Moving someone between them on your own initiative is not. And explicit consent here is a consumer-law concept, not a cookie banner. The Commission services' Questions and Answers put the case squarely at question 2.2.6: where the customer is sent to another website, "for instance a country-specific one", for those reasons, "redirection can only occur either with explicit consent of the customer or because of a specific legal obligation upon the trader to do so". Ecommerce Europe's Q&A factsheet calls that consent an opt-in mechanism. Neither document is an authoritative interpretation of the Regulation, and both say so.

The second subparagraph people skip

Article 3(2) does not end at consent. Its second subparagraph reads: "In the event of redirection with the customer's explicit consent, the version of the trader's online interface to which the customer initially sought access shall remain easily accessible to that customer." Recital 20 goes further: all versions should remain easily accessible at all times, and the customer must be able to withdraw consent at any point in time. The Commission's Q&A gives the mechanism in one line at question 2.2.3: the version the customer agreed to be sent to "should have an easily accessible button to take the customer back to other versions of the same website". A visible country switcher is therefore the compliance mechanism for the second half of the clause, not a nice-to-have.

A link that decides where an EU shopper lands is a technological measure. The text does not care whether the decision happened on your server or inside a six-character short URL.

Paragraph 3: the only automatic redirect the text allows

If the redirect "is necessary in order to ensure compliance with a legal requirement laid down in Union law, or in the laws of a Member State in accordance with Union law", you may do it without consent. The price is transparency: "a clear and specific explanation" of why, and it "shall be given in the language of the online interface that the customer initially sought to access." Recital 21 shows the shape of a qualifying law: national rules that limit access to certain goods or services, "for instance by prohibiting the display of specific content in certain Member States". Watch the trap here. Gambling, audiovisual, transport, healthcare and financial services are carved out of the whole Regulation by Article 1(3), which excludes the activities listed in Article 2(2) of the Services Directive, so they are a scope answer rather than an Article 3(3) answer. And "our legal team prefers it" is not a legal requirement.

Half the panic about geo-blocking comes from rules that do not exist.

Tap to enlarge

Different prices, and no duty to ship everywhere

Article 4(2) is explicit: the prohibition "shall not prevent traders from offering general conditions of access, including net sale prices, which differ between Member States or within a Member State" as long as they are offered on a non-discriminatory basis. A German shopper may not be refused the French price on the French store because she is German, but she is not entitled to the French price while shopping on the German store. Price harmonisation across your EU stores is not required. Recital 28 adds that nothing here obliges you to deliver cross-border where you do not already offer it: a customer from another member state can buy at your local conditions, then supply an address in your delivery area or arrange collection. That matters for link design, because the reason you redirect is usually delivery and tax plumbing. Keep the plumbing; stop the silent move. The market pattern is in the ecommerce playbook.

A country chooser is not geo-blocking

Nothing stops you from detecting a country and suggesting the matching store. Suggestion plus a one-click confirmation is an opt-in; detection plus an automatic redirect is the prohibited act. The legal difference is who presses the button, which matters more than the vendor in the geo-redirect tool roundup.

Scope is where most of the real answers live, and it is what a one-line summary always gets wrong.

A customer can be a business

Article 2(13) defines customer as a consumer who is a national of or resident in a member state, or an undertaking established in one, receiving or seeking a good or service in the Union "for the sole purpose of end use". A Dutch studio buying a monitor for its own office is a customer; the same studio buying monitors to resell is not. If your B2B pages route by country, that buy-to-resell test decides whether Article 3 applies at all, and you cannot tell from the click.

The EEA is in, the UK is out, and UK traders selling in are not

The Regulation carries the tag "Text with EEA relevance" and was incorporated into the EEA Agreement: EEA Joint Committee Decision No 311/2019 of 13 December 2019 added it to Annexes X and XIX of the EEA Agreement, OJ L 68, 5.3.2020, p. 65, and it entered into force in the EEA on 1 August 2020, once the constitutional requirements had been notified. Iceland, Liechtenstein and Norway count too. The UK went the other way: SI 2019/880, made on 18 April 2019, revoked the retained Regulation and the 2018 enforcement instrument. A UK shopper has no Article 3 right. A UK trader selling into the EU is still caught, because Recital 17 applies the Regulation to all traders operating within the Union, including those established in third countries and online marketplaces.

That last row is the one almost every explainer fumbles. A digital-content seller is exempt from the equal-conditions rule in Article 4(1)(b) and still fully bound by Article 3. Streaming video is different again: audiovisual services are out of scope altogether.

Tap to enlarge

Every explainer of this Regulation, from law-firm alerts to the Commission's own Q and A, describes a page. The Commission covers websites, apps and marketplaces alike. None of them describes a link that decides the destination before any site loads, now the default way campaigns handle several markets.

What did the customer "initially seek"?

Article 3(2) hangs on a comparison: the version you sent them to versus "the online interface to which the customer initially sought access". On a website that is obvious. On a short link it is arguable: a visitor clicking flyn.co/abc did not ask for your German store, they asked for an opaque six-character URL. One reading is that nothing was initially sought, so nothing can be compared. The other is that 3(2) exists to stop traders steering customers between country versions by location, and a link is a faster place to do it.

We could find no published decision or regulator guidance applying Article 3(2) to a redirect that happens inside a link rather than on a page. Take the conservative reading anyway, for a textual reason. Article 3(1) catches blocking done "through the use of technological measures or otherwise", and Article 3(2) goes further by naming no mechanism at all: it describes an outcome, a customer who ends up on a version specific to another nationality or residence. Nothing in that wording turns on which layer made the choice, and a regulator asking why a German shopper who clicked your campaign link landed on a different store will not be moved by an argument about what a short URL semantically promises.

The three patterns that survive, and the two that do not

Translate the text into link behaviour and you get five patterns. Three are defensible.

1. Opt in, then route, then remember. The link goes to your own page, the visitor confirms their market once, and you store the preference. Recital 20 says you need not ask again.
2. Route everyone to a chooser you control. The link resolves to one page that suggests the local store and lists the others. You keep the per-market funnel; the customer makes the choice.
3. Route because a law requires it, and explain. Article 3(3), with a clear and specific explanation in the language of the version first sought.

Pattern 2 is what our country targeting guide means by a consent-first page, so classify it properly. A chooser page is compliant when it offers the same goods and conditions the visitor could have reached alone and leaves every version one click away. It stops being compliant the moment it hides an assortment or a price from a customer in another member state, which is Article 4 territory.

The two that fail are the ones most commonly shipped: silently resolving one short link to different country storefronts, and redirecting with no visible way back. The second catches people who assume consent fixes everything. An unreachable original breaches the second subparagraph of Article 3(2) even when the opt-in was perfect.

Tap to enlarge

What Flyn's geo routing does, and what it cannot do

A Flyn short link is a 302 redirect. Geo routing matches on country only, never on language, with a fallback destination for every country you did not name; it sits on Pro, Lifetime and Team alongside device routing. Links carrying routing rules are not cached, so the decision is taken per request, not served from an edge cache that could hand a French visitor a German answer. A click records country, city, device, OS, browser, referrer, a hashed IP, UTM values and a timestamp: no advertising identifier, and as of 10 September 2026 no cookie.

The honest limit: Flyn routes, it does not ask. There is no built-in consent prompt or chooser interstitial, so patterns 1 and 2 both need a page you own. Setup steps for the rules are in geo-targeting links by country and route by country or device; this page is about what you may point them at.

Now the part that decides how much to spend on this. Enforcement is not centralised: Article 7 makes each member state designate its own enforcement bodies and set measures that are "effective, proportionate and dissuasive", and Article 8 a body to help consumers, usually the European Consumer Centre.

The fines on paper versus the fines in practice

The European Court of Auditors audited the regime in special report 03/2025. Its findings on penalties are blunt: minimum fines range from 26 euros to 900,000 euros and maximum fines from 1,448 euros to 5 million, with some states calculating by turnover and some allowing criminal liability. The honest answer to "what is the fine" is that it depends on which authority picks up the file.

Practice is milder than the ceilings. Of the 18 enforcement bodies that answered the auditors' survey, only two had ever penalised a trader under the Regulation and five had run their own checks. In 2021 Sweden's Konsumentverket audited 78 online companies against Articles 3 and 4(1), found that 24 of the 32 offering in-store pick-up demanded a Swedish postal address, and sent letters rather than fines. Portugal's ASAE opened two infringement proceedings under Article 4(1) and issued penalties instead.

Complaints are rare, and Article 3 requests rarer than Article 4 ones

Across six years of European Consumer Centre data, April 2018 to April 2024, the auditors found an average of roughly 290 questions and 55 complaints a year about geo-discrimination, about half resolved amicably with the trader. Of 40 cross-border mutual-assistance requests between authorities, 26 concerned Article 4 and only three concerned Article 3 alone, with four more citing Articles 3 and 4 together. Read that sample carefully: 31 of the 40 came from a single member state, which on 29 of those occasions asked another state's authority to act against a trader, so it measures one authority's appetite rather than an EU-wide pattern. Commission mystery shopping found the share of cross-border shoppers redirected or refused access fell from 3.4 percent in 2015 to 2.9 percent in 2019, against roughly 65 percent of websites applying some geo-blocking in both 2016 and 2019.

Tap to enlarge

Read that honestly. Your realistic risk is not a headline fine; it is one annoyed shopper, one national authority, a letter, and a scramble. A chooser page and a switcher cost less than that, and they stop the quiet conversion loss of dumping people on a store that cannot ship to them.

Run this once per campaign, against the text of Article 3 rather than somebody's summary of it.

Tap to enlarge

The six checks

1. Name the legal route. The visitor opts in, a chooser page decides, or you can name the law that forces the redirect. None of the three means no lawful pattern.
2. Make the original reachable. A visible country switcher on every market version, on every page. That is the second subparagraph of Article 3(2), not a UX preference.
3. Ask once and store it. Record the opt-in, do not re-prompt every visit, and offer a way to withdraw it.
4. Check your scope. EU and EEA shoppers are in; UK shoppers, resellers, audiovisual and transport are out. Digital-content stores are in for Article 3 though Article 4(1)(b) exempts them.
5. Keep prices and assortment honest. Different prices per market are fine. Using the redirect to hide a cheaper market, or to shrink what a foreign customer sees, is what Article 4 is about.
6. Write the Article 3(3) explanation before you need it. Clear, specific, and in the language of the version the customer first sought.

Add two things to the same release. Tag each market destination with the UTM builder so the chooser page does not flatten your reporting, and confirm the parameters survive the hop, which is the subject of do short links keep tracking parameters. Per-country click breakdowns, the Pro half of the analytics, then tell you whether the chooser helps or leaks.

The compliant version is barely more work. The stack for a multi-market EU campaign:

The practical build

• One branded short link per campaign on your own custom domain, so the hop is recognisable.
• The link points at a chooser page you control, not at a country storefront. Suggest the local store, list the rest, remember the choice.
• Country routing behind the scenes only where the offer is identical across markets, or where you already hold a stored opt-in.
• A country switcher in the header of every market site, plus hreflang tags for the search side.
• Per-market UTMs, and a line in the runbook naming which lawful pattern this campaign uses.

New to this? Create a short link, then add routing; one URL serving several destinations is what smart links are, and the device case is one link, different destinations by device. Shopify store links behave the same way. The API side is in the links docs, the hop itself in URL redirects.

The disclaimer, and it matters here

This is general information, not legal advice. Regulation (EU) 2018/302 was read on 10 September 2026, and no enforcement decision or regulator guidance we could find applies Article 3(2) to a redirect inside a link rather than on a page, so the patterns above are a conservative reading of the text, not settled law. Your obligations depend on your markets, sectors and customers. Check the data-protection side in our GDPR overview, read the terms, and take advice from a qualified professional before a large launch. Routing sits on Pro, Lifetime and Team; to try the plain version first, create a free account.