Utah's VPN Law Is A Declaration Of Tech Illiteracy

Ostensibly spurred on by concerns around online child safety, nations around the world have started implementing ID and age verification requirements to restrict minors' access to social media and supposed adult content. Some platforms, like Discord, also imposed their own verification processes preemptively. But the internet does not respect borders, and savvy users have found that bypassing these barriers is as easy as using a VPN. VPNs route a user's traffic through remote servers, making it appear as though the traffic originates from someplace other than the user's physical location.

One U.S. state that has implemented age verification and ID laws is Utah, which passed a law (Senate Bill 73) requiring adult platforms to verify a user's age if that user is in Utah. The outcome was as obvious as stepping on a rake: many porn sites blocked users from the state, and residents looking for some steamy action had to use a VPN.

Now, Utah has decided to target the VPNs themselves. A new amendment took effect on May 6, imposing penalties on websites found to provide access to users who are geo-spoofing. If you know even the bare minimum about VPNs, you'll know this makes no sense, since the entire function of a VPN is to hide a user's location from the websites they visit. It is an unworkable and burdensome law that will only cause headaches for everyone involved, whether or not they live in Utah. The question then becomes whether Utah's legislators are malicious or merely tech-illiterate. Here's what you need to know.

Utah's new amendments to Section 14 of SB 73 do not ban VPNs outright, nor do they target users. Instead, they target the websites users visit while using a VPN. The problem here is that a website won't know that a Utah resident is using a VPN. It will simply see a user in, say, Denver requesting access; since there are no such restrictions in Colorado, the website will load normally. Even so, that website could now be in violation of Utah law, despite no fault of its own. Equally concerning is another portion of the amendments that prohibits websites from publishing instructions on using a VPN, which the Electronic Frontier Foundation (EFF) points out may violate the First Amendment.

Websites are being put between a rock and a hard place, which is why NordVPN, a popular provider, referred to the amendment as a "liability trap" (via TechRadar). Blocking VPN service to Utah entirely won't work for the reasons outlined above, but expanding the blocked service region to include neighboring states is equally useless, as a user can use a VPN server further afield. Websites could block traffic from IP addresses commonly associated with VPNs to stay safe, but that would affect users outside of Utah, too, and it would only work for static VPN IPs — leaving dynamic IPs as a loophole.

There's only one obviously bulletproof fix: universal age verification. In other words, the easiest way to comply with this Utah law is for websites to apply the law globally. Meanwhile, mainstream devices, including Apple products, already have features to protect children online, throwing that entire effort into question.

Utah's SB 73 seems set to prove that the only way to restrict internet traffic is to uproot the fiber-optic cables it runs through. In the meantime, though, the new amendment will likely sow chaos  — and that might be by design. While you may think the law, however badly written it may be, will only affect adult websites, the changes were introduced alongside a broadening of the law's scope.

Previously, it only affected websites with explicit sexual content based on a three-pronged obscenity standard taken from precedent in constitutional law. But now, a website must only fulfill one of the three criteria, one of which is merely material that, in the bill's wording, "taken as a whole lacks serious literary, artistic, political, or scientific value for minors." In other words, any website that does not focus almost exclusively on providing educational content could be at risk. As the privacy advocate group State of Surveillance points out, this law is likely to disproportionately impact vulnerable groups, such as domestic abuse survivors and LGBTQIA+ youth in hostile households, by outing their identities when they seek resources and support online.

The most vocal critics, such as the EFF, also point out that even a VPN ban with a sensible framework wouldn't stop motivated users. These users may simply switch to VPN alternatives like proxies and tunnels, which can also dodge IP-based geolocation. Meanwhile, websites worried that they'll run afoul of the law may move to collect age verification from every user, regardless of location, doing immense damage to the ability of journalists, political dissidents, targets of oppressive regimes, and ordinary citizens to protect their online privacy. Utah lawmakers have weaponized tech illiteracy.