So the individual website has to subscribe to the surveillance operator's IP location verification service, or be fined.

Basically. Party of small government, my ass.

Edit: actually, not even then. In my home VPN scenario, the IP is a legitimate residential connection.

This is exactly it. Compliance is a big business. When your company's lawyers tell you you've gotta do something then you do it. Half my team is wasting time on this bullshit and big money is getting paid to those who make the lists.