OFAC sanctions are far more nuanced than what you make them out to be. Very often "general licenses" are carved out for providing IT services or technology to individuals for personal use. The purpose of this is for censorship circumvention, which often supports American interests abroad.
This is not something that you apply for; a general license already applies to everyone. The legalese or restrictions companies use exist because they cannot (or will not) validate everyone is who they say they are. This obviously doesn't apply to companies who deal with controlled exports, where they are responsible for whoever ultimately receives the controlled export.
I am not a lawyer and this is not legal advice.
https://ofac.treasury.gov/selected-general-licenses-issued-o...
I get this, but you say "very often", but it's not, and generally, looking at OFAC lists, there's only a few countries with personal carveouts (less than 5 of the countries on the list), usually for remittances, and in a few of those countries only to US persons residing there.
Generally the software carveouts are very limited - it's not just "providing IT services or technology to individuals for personal use", i.e. Sudan:
> software updates for medical devices to Sudan
Indeed, of the software carveouts listed on that page, only two are not related to the operation or update of medical devices:
- provision of Internet services to the people of the Ukraine (read: "Starlink")
- provision of messaging services to members of the Government of Venezuela.