'A technical whack-a-mole:' Utah to become the first US state to target VPN users with controversial age verification law and digital rights experts are furious

Date:
Fri, 01 May 2026 12:08:36 +0000

Utah is set to become the first US state to penalize websites for failing to verify the age of users who mask their location with a VPN, a move that
privacy experts are warning could fundamentally break the internet's architecture of anonymity.

Set to take effect on May 6, 2026, the states Online Age Verification Amendments, formally known as Senate Bill 73 , will require adult websites to enforce strict age checks on anyone physically located in Utah. Crucially, companies will remain liable even if a visitor uses a VPN service to spoof their geographic location.

This marks the first time a US state will rule out legislation that directly targets the use of a VPN to bypass legally mandated age gates.

While a recent push in Wisconsin to ban VPNs was scrapped due to heavy backlash, Utah's legislation survived and is now drawing fierce criticism
from civil liberties groups and tech companies alike.

Under SB 73, signed into law by Governor Spencer
Cox on March 19, 2026, a user is considered to be accessing a website from Utah if they are physically there, regardless of any proxy server or VPN masking their IP address .

The law also takes aim at information sharing. It prohibits commercial entities hosting a "substantial portion of material harmful to minors" from providing any instructions on how to use a VPN to circumvent these checks.

While it stops short of an outright ban on using a VPN, the Electronic Frontier Foundation (EFF) warns that the mandate is built on a "don't ask, don't tell" style of enforcement.

The EFF also argues that preventing platforms from sharing basic, truthful information about a lawful privacy tool raises massive constitutional
concerns regarding free speech. (Image credit: Shutterstock) Backlash is also coming from the VPN industry. Back in March, NordVPN strongly condemned the bill , telling TechRadar that blocking all known VPN and proxy IPs is "technically impossible."

Because no comprehensive blocklist exists, the EFF echoed that the
requirement is simply a "technical whack-a-mole that likely no company can win."

NordVPN argues that the law creates an "unresolvable compliance paradox" for responsible operators. Instead of protecting minors, the company warned that the legislation will "simply punish lawful users who care about their
privacy, globally." Ultimately, NordVPN states: "It is a liability trap."

By effectively holding websites liable for the actions of users masking their locations, the legal risk may push platforms to adopt blanket age checks for all internet traffic. As the EFF notes, this would force regular citizens to hand over their data to brokers and third-party verification tools. A global war on anonymity Utah's crackdown is not an isolated incident. Across the globe, lawmakers are increasingly treating VPNs not as critical security tools, but as obstacles to online regulation.

In the UK, the government recently confirmed it may "age restrict or limit children's VPN use" following a three-month consultation designed to "close loopholes that put children at risk."

Ultimately, privacy experts are deeply concerned that this global push will normalize mass surveillance.

Andy Yen, CEO of Proton, recently warned that "age verification as is currently being proposed in country after country would mean the death of anonymity online."

Link to news story: https://www.techradar.com/vpn/vpn-privacy-security/a-technical-whack-a-mole-ut ah-to-become-the-first-us-state-to-target-vpn-users-with-controversial-age-ver ification-law-and-digital-rights-experts-are-furious

$$
--- MultiMail/DOS
* Origin: Capitol City Hub (1:2320/105)