It's not even plausible deniability, it's literally "how are we supposed to know what location people are in other than ISP?" That's the de facto determinate of location online. The government hasn't taken the position that a bar checking driver's licenses to confirm someone's age provides "plausible deniability", but rather that they're doing their part to comply with the law, even if some users are going to use fake IDs to cheat the system.
1/ block data center connections / require users to connect via a residential IP, not cell phone.
2/ request GPS location from the device.
3/ request WiFi location from the device.
4/ require billing address to be out of state. (States collect sales tax based on billing address, not where the service or product is bought. So I think this is fair.)