Configuring geo rules

Geo rules decide who sees your core product and who sees sponsored offers. It's one decision, usually set once, and it's the most important switch in the dashboard.

How geo rules work

When a visitor loads your page, the widget calls GET /v1/decision with the visitor's country (and region, when available: resolved server-side from the IP). The API compares that to your rule and returns { allowed: true } or { allowed: false }.

Each website has one geo rule with a mode:

• Allowlist: you list the countries / regions where your product is available. Everyone else sees offers.
• Blocklist: you list the countries / regions where your product isn't available. Those listed see offers.

Both modes support country-level entries (US, DE, SE) and region-level entries (US-NJ, US-MI). A visitor matches if their country or their country + region combination is on the list.

Set rules for a website

1. Open the website

   Dashboard → Websites → click the site you want to configure.

2. Go to Geo rules

   Open the Geo rules section on the website detail page.

3. Pick a mode

   Allowlist or Blocklist: see the decision shortcuts below.

4. Add countries (and regions, if relevant)

   Countries use two-letter ISO codes (US, DE). Regions use <COUNTRY>-<REGION> (US-NJ). For sub-national regulated markets (US states, Canadian provinces), add the region codes directly.

5. Save

   The next /v1/decision call uses the new rule. No cache, no redeploy.

Allowlist vs blocklist: which one?

• Use allowlist when your product is available in a short, known list of countries. Example: "licensed only in UK, MT, SE" → put those three on the allowlist. Every other country gets offers.
• Use blocklist when your product is available almost everywhere and you have a short list of exclusions. Example: "available globally except US + CA + FR" → blocklist those three. Everyone else sees your normal product.

If in doubt, start with allowlist. It's the default assumption for regulated verticals and produces the safer error mode (worst-case you show offers to legitimate traffic; you never accidentally show your unlicensed product to a regulator).

Common shapes

Single country, nation-wide

Most common for EU / UK operators. Allowlist, add one country (e.g. SE). Every visitor outside Sweden sees offers.

Multiple countries, nation-wide

Global brands with licenses in each country. Allowlist, add all allowed countries:

• Sportsbooks licensed in UK, Ireland, Spain, Malta.
• Crypto exchanges allowed in EU + UK + CH + JP.
• Streaming services with regional catalogs.

Sub-national (US states)

Required for US operators. Allowlist, add US-<STATE> for each regulated market:

• iGaming: US-NJ, US-PA, US-MI, US-WV, US-CT.
• Sports betting: wider set including US-VA, US-CO, US-TN, US-AZ.

Launching in a new state or country

Edit the rule, add the new code, save. The next page view picks it up. Want to roll back? Remove the entry and save again.

Custom decline messaging

You can attach custom copy to the blocked experience: the headline and description visitors see above the offers. Useful for:

• Maintaining your brand voice on the blocked path.
• Explaining why your product isn't available (regulatory, technical, content rights).
• Pointing to a support page or region-specific landing.

Look for the custom title and custom subtitle fields on the geo rules form. Both are optional and sit on top of the offer grid.

Tips

• Start tight. On allowlist mode, it's easier to widen rules (add a country) than to debug "why aren't offers showing" (you forgot to remove one).
• Rules are per-website. If you run multiple sites under the same account, each one has its own rule: copying isn't automatic. This is a feature (allows per-site licensing) but a common source of "I updated and nothing happened" confusion. Check the right site first.
• Use Analytics to see where your blocked traffic actually comes from. You might discover monetizable traffic from countries you hadn't considered.
• VPN traffic gets flagged automatically. Suspect-proxy signals land in the event log; you don't need a second tool.

Related