I got a client that wants to remove the 'GDPR please accept our cookies' banner when the user is NOT in the EU. (Its an NA based company)
So the way we could do it, with PHP, would be to check the IP of the user, by some black magic figure out on the fly where that comes from and then if the country is not within the list of countries of the EU, well dont show the bar.
But my insecurity posed this. Say a user, from the EU, uses a VPN. Those services announced everywhere that can spoof their IP and make it seem like the user is from somewhere else (like what they advertise is make Netflix think you are in japan, so you got the japan Netflix library). Would that user still be subject to GDPR?
To wrap it up: Would a user that is physically in the EU, but spoofs their IP to trick the code into thinking he's not still be under GDPR protection (and thus, if you don't make him accept the cookies, you could be in legal trouble)