This really is a hard stop being applied on Cloudflare WAF rules to stop any traffic from geo locations a sys admin believes would stop threats and also reduce their bandwidth utilisation. If companies don’t have business interest outside or their territory/ country the new trend seems to be just geo block that domain. While https://investor.caseys.com/ is accessible from Europe for eg., the main site isn’t . This isn’t a GDPR thing just a playbook some of the cyber security and ops team seem to be applying across various retail companies now a days .