> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Further, the GDPR has rules around two things you mention, but they are different: (1) profiling; (2) automated decision making.
Profiling has three elements, as described by the A29 WG:
* An automated form of processing.
* Carried out on personal data.
* For the objective of evaluating personal aspects about a natural person.
Blocking users from using your site is highly unlikely to have the "legal effects" enumerated in the above clause.
CJEU case law has determined that IP addresses are not considered "personal data" except in certain cases (https://www.whitecase.com/publications/alert/court-confirms-...)
> The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:
> 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and
> 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual.
> On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD.
The vast majority of entities do not meet the requirements for #2. Therefore, automatic profiling rules could not apply since the automatic analysis being performed is not against personal data.
GEO-IP is not a profile unless it is stored with additional data.