Ostensibly spurred on by concerns around online child safety, nations around the world have started implementing ID and age verification requirements to restrict minors' access to social media and supposed adult content. Some platforms, like Discord, also imposed their own verification processes preemptively. But the internet does not respect borders, and savvy users have found that bypassing these barriers is as easy as using a VPN. VPNs route a user's traffic through remote servers, making it appear as though the traffic originates from someplace other than the user's physical location.
One U.S. state that has implemented age verification and ID laws is Utah, which passed a law (Senate Bill 73) requiring adult platforms to verify a user's age if that user is in Utah. The outcome was as obvious as stepping on a rake: many porn sites blocked users from the state, and residents looking for some steamy action had to use a VPN. Now, Utah has decided to target the VPNs themselves. A new amendment took effect on May 6, imposing penalties on websites found to provide access to users who are geo-spoofing. If you know even the bare minimum about VPNs, you'll know this makes no sense, since the entire function of a VPN is to hide a user's location from the websites they visit. It is an unworkable and burdensome law that will only cause headaches for everyone involved, whether or not they live in Utah. The question then becomes whether Utah's legislators are malicious or merely tech-illiterate. Here's what you need to know.
A geofenced ban on VPN traffic is technically unenforceable
Utah's new amendments to Section 14 of SB 73 do not ban VPNs outright, nor do they target users. Instead, they target the websites users visit while using a VPN. The problem here is that a website won't know that a Utah resident is using a VPN. It will simply see a user in, say, Denver requesting access; since there are no such restrictions in Colorado, the website will load normally. Even so, that website could now be in violation of Utah law, despite no fault of its own. Equally concerning is another portion of the amendments that prohibits websites from publishing instructions on using a VPN, which the Electronic Frontier Foundation (EFF) points out may violate the First Amendment.
Websites are being put between a rock and a hard place, which is why NordVPN, a popular provider, referred to the amendment as a 'liability trap'. Blocking VPN service to Utah entirely won't work for the reasons outlined above, but expanding the blocked service region to include neighboring states is equally useless, as a user can use a VPN server further afield. Websites could block traffic from IP addresses commonly associated with VPNs to stay safe, but that would affect users outside of Utah, too, and it would only work for static VPN IPs — leaving dynamic IPs as a loophole. There's only one obviously bulletproof fix: universal age verification. In other words, the easiest way to comply with this Utah law is for websites to apply the law globally. Meanwhile, mainstream devices, including Apple products, already have features to protect children online, throwing that entire effort into question.
Critics say Utah's VPN ban appears designed for chaos
Utah's SB 73 seems set to prove that the only way to restrict internet traffic is to uproot the fiber-optic cables it runs through. In the meantime, though, the new amendment will likely sow chaos — and that might be by design. While you may think the law, however badly written it may be, will only affect adult websites, the changes were introduced alongside a broadening of the law's scope. Previously, it only affected websites with explicit sexual content based on a three-pronged obscenity standard taken from precedent in constitutional law. But now, a website must only fulfill one of the three criteria, one of which is merely material that, in the bill's wording, 'taken as a whole lacks serious literary, artistic, political, or scientific value for minors.' In other words, any website that does not focus almost exclusively on providing educational content could be at risk. As the privacy advocate group State of Surveillance points out, this law is likely to disproportionately impact vulnerable groups, such as domestic abuse survivors and LGBTQIA+ youth in hostile households, by outing their identities when they seek resources and support online.
The most vocal critics, such as the EFF, also point out that even a VPN ban with a sensible framework wouldn't stop motivated users. These users may simply switch to VPN alternatives like proxies and tunnels, which can also dodge IP-based geolocation. Meanwhile, websites worried that they'll run afoul of the law may move to collect age verification from every user, regardless of location, doing immense damage to the ability of journalists, political dissidents, targets of oppressive regimes, and ordinary citizens to protect their online privacy. Utah lawmakers have weaponized tech illiteracy.
The technical underpinnings of VPNs are often misunderstood by legislators. A VPN creates an encrypted tunnel between the user's device and a remote server operated by the VPN provider. All internet traffic passes through that tunnel, and the website sees only the IP address of the VPN server. This means geolocation based on IP is completely unreliable for detecting the user's actual physical location. Even if a website attempts to block known VPN IP addresses, there are thousands of IPs constantly rotating, and many VPN services offer dedicated IPs or allow users to change their server at will. Additionally, obfuscation techniques can make VPN traffic appear as ordinary HTTPS traffic, further complicating detection. The only way to reliably detect a VPN would be to inspect encrypted traffic, which would require either breaking encryption or deploying invasive network monitoring — both legally and technically problematic.
Beyond the technical impossibility, the law raises serious constitutional questions. Free speech advocates argue that the prohibition on publishing instructions for using a VPN directly violates the First Amendment. Providing information about how to bypass censorship or geo-restrictions is a protected form of speech, especially when used for legitimate purposes such as accessing news in authoritarian countries or protecting one's privacy from state surveillance. Utah's law could potentially chill the online publication of any content related to circumvention, including how-to guides for journalists or activists. The EFF has already signaled that it may file a lawsuit challenging the amendment on these grounds.
The broader implications for internet governance are troubling. If states can impose geofencing requirements on websites for any reason, we could see a patchwork of conflicting regulations. A website might be required to block VPN users from Utah, but allow them from Texas, all while having no way to distinguish between the two. This could lead to a race to the bottom, where sites either implement global age verification (collecting sensitive government-issued IDs from every user) or block all traffic from suspicious IPs, effectively censoring large swathes of the internet. The burden falls disproportionately on smaller websites and platforms that lack the resources to implement sophisticated geolocation systems.
Meanwhile, the original goal of protecting children remains unmet. Studies have shown that age verification systems are easily circumvented by tech-savvy minors, who can use pre-paid gift cards, stolen credit cards, or simply lie about their age. Even if a system works technically, it collects vast amounts of personal data, creating new privacy risks. The most effective way to protect children is through education, parental controls, and platform design that defaults to safety features, not through heavy-handed legislation that undermines the very fabric of an open internet. Utah's VPN law is not just a misguided attempt at enforcement; it's a declaration that the state's lawmakers do not understand how the internet works, and their solution will cause more harm than good.
Source: SlashGear News