This works for physical goods. For SaaS stuff, if you look at the billing address only, you’ll just get a ton of users from 67 Keysmash Lane, Anytown, 10000 CA, US. (Yeah that’s not a real zipcode for CA, but don’t tell me you’re validating those and don’t even look at the IP addresses :-)
This could give you plausible deniability perhaps, if you do want users from Germany, but don’t want to deal with German laws, and are willing to argue in the German court that you didn’t know these users are from Germany because they’ve said “I’m not from Germany, pinky promise”. (Or if you have no intention of ever being in Germany and are sure that Germany can’t get to your bank accounts to fine you.)
No, I'd look at IP addresses before validating zipcodes, true ;) What I'm thinking is, if someone wants to deceive a service provider about her billing address, that's a social problem. Social problems are insanely hard to fix with technology, if at all.
So what is reasonable to request from the service provider here? Checking billing address and IP is reasonable, but beyond that? Maybe bank account? But in Europe a German can have a bank account in France, it is not even a big deal. Maybe taxation should follow bank accounts? I have an account in Luxembourg, so I'm set ;)
This could give you plausible deniability perhaps, if you do want users from Germany, but don’t want to deal with German laws, and are willing to argue in the German court that you didn’t know these users are from Germany because they’ve said “I’m not from Germany, pinky promise”. (Or if you have no intention of ever being in Germany and are sure that Germany can’t get to your bank accounts to fine you.)