GeoIP isn't really a good solution. I work on a large ecommerce site and this comes up from time to time. GeoIP databases are unreliable at best, especially for areas where IPs tend to jump borders (e.g., Toronto and Detroit)
But they wouldn't need to use it for anything critical. Just for a message like, "It appears that we can't ship this to your current location: Calgary, AB, Canada. Please _log in_ to check availability to your shipping address," or something along those lines.
And if it thinks I'm in Montana? I don't get that message, and assume since in the past it knew I was in Calgary so I must be safe to add it to my cart.
At least I know right now that I have to log in all the time to be sure I can safely add items to my cart
But the worst case then is that you add something to your cart and then find out later that you can't buy it, just like now. It's not going to make the cart self-destruct. ;)
If it thinks you're in Montana once, it's probably going to every time. So you'll see exactly what you see now. Heck, maybe this is exactly what they DO do, and it thinks I'm in Washington so I never get a message. :) But for the majority of cases where it can geolocate the country properly, at least to the resolution of US vs not-US, it would be helpful.
