Typically things like this go off the IP address. And while it is more difficult than going off of an inputted address, it isn't that difficult.
But it is also what you need to do. As an American, if I travel to Europe I'm protected by gdpr laws (and one reason why I get spamed by the "accept cookie" popups even from sites I normally visit it have a US address associated.
Someone physically located in the EU using a VPN with an endpoint outside the EU is still covered by the GDPR. Just going off IP address will miss this.
