Utah age assurance law for VPN users takes effect this week

Privacy advocates and virtual private network (VPN) providers are up in arms over Utah’s Senate Bill 73 (SB 73), “Online Age Verification Amendments,” which applies to any user located in Utah, regardless of whether or not they are using a VPN to mask their geolocation.

At issue is a section which previously specified that “a commercial entity that is found to have violated this section shall be liable to an individual for damages resulting from a minor’s accessing the material, including court costs and reasonable attorney fees as ordered by the court.”

The latest version, which takes effect this week, now reads as follows: “an individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this State.”

In other words, Utah’s law applies to anyone in Utah, regardless of whether or not they are pretending to not be in Utah.

This, says the Electronic Frontier Foundation (EFF), is not fair, and claims in a blog post that, “due to constitutional and technical concerns, Utah is proceeding with a mandate that threatens to significantly undermine digital privacy rights.”

“By holding companies liable for verifying the age of anyone physically in Utah, even those using a VPN, the law creates a massive ‘liability trap’,” EFF says. “If a website cannot reliably detect a VPN user’s true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally. This would subject millions of users to invasive identity checks or blocks to their VPN use, regardless of where they actually live.”

EFF makes the error of conflating age assurance with identity checks – a mischaracterization that ultimately supports their position: the less people know about privacy preserving age checks, the easier it is to drum up fear in the name of digital freedom.

A particularly absurd objection targets a section of the law disallowing sites that host “a substantial portion of material harmful to minors” from providing instructions on how to circumvent digital age checks by using a VPN. EFF says “this raises significant First Amendment concerns, as it prevents platforms from providing basic, truthful information about a lawful privacy tool to their users” – as though it would be natural for, say, a gun safe to come with instructions on how to pick the lock. (Legally, free speech, but logically, a deliberate undermining of the security tool’s purpose.)

NordVPN says blocking all VPN, proxy IPs can’t be done

Shockingly, popular VPN provider NordVPN is also unhappy about Utah’s law. In a statement made to Tech Radar, the firm says “blocking all known VPN and proxy IPs in Utah is technically impossible because providers constantly add new addresses and no comprehensive blocklist exists.”

It also says that “attempting to comply would have serious consequences for lawful users worldwide. As currently written, the bill does not appear to give adult sites the option to simply exit the Utah market to avoid the rules.”

“Instead, the only remaining option appears to be age-verifying every visitor globally, regardless of their actual location.”

This is a tortured bit of reasoning, which has a whiff of desperation to it; it also uses “age verification” as a catch-all for age assurance, which includes biometric methods such as facial age estimation that do not require a date of birth.

EFF arguments rooted in bygone digital era

The VPN question continues to be a reliable salt lick for opponents of age assurance legislation. Their arguments rest in part on feasibility; it’s not feasible, they say, to regulate the internet, which is by its nature “built to route around censorship.”

Increasingly, this in itself looks like an unfeasible position. The internet of the 1990s, when many of the core principles of the tech movement took shape, was a much different beast than today’s online environment. Failing to recognize this results in a grave miscalculation of what matters most in a society. Much as it appears unfeasible to maintain that a Constitution drafted in 1787 should still be interpreted literally in 2026, an unregulated internet has proven to be a dream that belongs in the 20th century. The tech lords of Silicon Valley, now the wealthiest men in the world, have insisted on integrating technology deeper and deeper into our lives: smartphones, smart appliances, AI chatbots, AI agents. The age of Geocities is over; the rules have changed utterly.

EFF argues that “attacks on VPNs are, at their core, attacks on the tools that enable digital privacy.” But in the age of social media, personal brands and endless posting, the value of digital privacy has fallen, while the cost has risen.

The organization is partly correct, however, in noting that, “as this law goes into effect next week, we are entering uncharted territory.” The fact is, we are already in uncharted territory. Age assurance laws are an attempt to put some boundaries into effect in the interest of keeping children away from porn, addictive algorithms and other potential harms.

Article Topics

age verification  |  EFF  |  legislation  |  United States  |  Utah age verification  |  VPN (virtual private network)