A U.S. State Now Holds Websites Liable for Users Who Hide Their Location With VPNs
Utah’s Online Age Verification Amendments, formally known as Senate Bill 73, went into effect on May 6, making it the first law in the United States to hold websites liable for users who mask their location with a VPN. Governor Spencer Cox signed the bill on March 19. The intent behind it is straightforward: stop people from using VPNs to slip past age verification barriers on sites carrying content deemed harmful to minors.
What makes this law different from earlier age verification efforts is a single, significant clause. A user is treated as being in Utah based on where they physically are, not where their internet traffic appears to originate. That means websites are on the hook even if a visitor’s VPN makes it look like they’re connecting from another state or country entirely. The law also bars covered platforms from sharing instructions on how to use a VPN to get around age checks.
The law follows proposed but ultimately scrapped VPN-related legislation in Wisconsin, which was pulled after significant public backlash. Similar bills have surfaced in Michigan. Utah’s version survived that scrutiny and is now drawing sharp criticism from digital rights organizations and the VPN industry. Privacy advocates and tech companies argue that what the law requires is not technically achievable in any consistent or reliable way.
Why Enforcement Is Harder Than It Sounds
The Electronic Frontier Foundation has described the compliance burden as “a technical whack-a-mole that likely no company can win.” No comprehensive blocklist of VPN IP addresses exists, and commercial VPN providers rotate their addresses regularly. Residential VPN endpoints are largely indistinguishable from ordinary home internet connections, making detection unreliable at best.
The only detection method that reliably identifies VPN traffic is deep packet inspection, which requires access to the network infrastructure sitting between a user and a server. That kind of access is available to governments running state-level surveillance systems, as seen in China and Russia, but it is not something a website operator can deploy on its own. The law effectively asks platforms to solve a problem that their technical position does not allow them to solve.
NordVPN has called the law both an “unresolvable compliance paradox” and “a liability trap,” arguing that rather than protecting minors, it will fall hardest on privacy-conscious users who rely on VPNs for legitimate reasons: journalists, people fleeing abusive situations, and individuals living under authoritarian governments, among others.
The Broader Impact on Everyday Users
Facing uncertain legal exposure, some websites may respond by blocking all known VPN IP addresses or requiring age verification from every visitor, regardless of location. The EFF notes that this path would push ordinary internet users to hand over personal data to third-party age verification brokers, a tradeoff that raises its own set of privacy concerns. The law’s reach may extend well beyond Utah’s borders in practice.
Setting up a personal VPN on a commercial cloud server takes only minutes for someone with basic technical knowledge, and no website operator can reliably detect it. That gap means the law is more likely to create friction for ordinary privacy-minded users on commercial VPN services than for anyone actively trying to circumvent age barriers.
Utah is not moving in isolation. The UK’s House of Lords voted 207 to 159 in January to ban VPN services for users under 18, with those measures now headed to the House of Commons. France’s digital affairs minister has publicly stated that VPNs are “next on my list.” Australia has enacted its own age verification measures, though critics have been vocal about their limitations. The pattern points toward a broader regulatory shift in how governments are approaching anonymity tools online.
Where This Is Headed
Andy Yen, CEO of Proton, has warned that age verification legislation, as it is currently being proposed across multiple countries, “would mean the death of anonymity online.” The EFF has framed Utah’s law as setting a precedent that “prioritizes government control over the fundamental architecture of a private and secure internet,” and argues the consequences will not stay within the state’s borders.
The debate sits at the center of a genuine tension: the goal of keeping minors away from harmful content online is broadly shared, but the technical and civil liberties costs of this particular approach are disputed. Supporters of the law argue that accountability has to extend to tools used to evade it. Critics say the law misunderstands how the internet works and will burden the wrong people.
For now, Utah is the first state to test this legal ground. Whether other states follow, and how courts ultimately respond to the constitutional questions this law raises, will shape what age verification looks like across the country and possibly beyond it.