Utah Law Makes Websites Liable for VPN‑Masked Users
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Utah's Online Age Verification Amendments (Senate Bill 73) take effect on May 6, making the state the first U.S. jurisdiction to explicitly target VPN use for age verification.
- Governor Spencer Cox signed the bill on March 19, defining any user physically in Utah as accessing a site from Utah regardless of VPN or proxy use and prohibiting sites from publishing VPN‑bypass instructions.
- NordVPN called the law an “unresolvable compliance paradox” and a “liability trap,” arguing it forces websites to identify users employing tools designed to be unidentifiable.
- Electronic Frontier Foundation warned the statute could push sites to block all known VPN IPs or require age verification for every visitor worldwide.
- Technical experts note the law’s reliance on VPN detection is flawed; IP reputation services can flag datacenter ranges, but VPNs rotate addresses, and reliable detection would require deep packet inspection, which website operators cannot perform.
- Critics say the rule will hurt non‑technical users who depend on VPNs for privacy, including journalists, political dissidents, abuse survivors and people living under authoritarian regimes.
- UK House of Lords voted 207‑159 to ban VPN services for under‑18s, while France’s digital affairs minister and Wisconsin have considered or rejected similar VPN restrictions.
Why it matters: Websites gain a new legal risk, while VPN‑dependent users—journalists, dissidents, abuse survivors, and those under authoritarian regimes—lose privacy protection. The statute may force sites to block VPNs or impose universal age checks, reshaping online access and enforcement in Utah and could set a precedent for other states.
