Utah's Online Age Verification Amendments

Utah has taken a significant step in online age verification legislation with the implementation of Senate Bill 73, which came into effect on May 6. This law makes Utah the first state in the United States to specifically address the use of Virtual Private Networks (VPNs) as part of its age verification measures.

Signed by Governor Spencer Cox on March 19, the bill introduces a new framework where a user is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN or proxy to conceal their IP address. Additionally, the law prohibits websites from providing instructions on how to use a VPN to bypass age checks.

NordVPN has criticized the law, calling it an "unresolvable compliance paradox" and a "liability trap." The company argues that the law holds websites responsible for identifying users whose tools are designed to be unidentifiable. The Electronic Frontier Foundation (EFF) has also raised concerns, warning that the legal risk could push websites to either ban all known VPN IPs or require age verification for every visitor globally.

Technical Flaws in the Law

The law faces several technical challenges. It assumes that web providers can reliably detect VPN traffic and determine a user’s true physical location — something that is not feasible. IP reputation databases such as MaxMind and IP2Proxy can flag traffic from known datacenter IP ranges, but commercial VPN providers frequently rotate addresses, and residential VPN endpoints are largely indistinguishable from standard home connections.

Autonomous System Number analysis can identify traffic originating from datacenter networks, but it cannot detect a personal WireGuard tunnel running on a cloud VPS, which routes through the same infrastructure as ordinary web hosting. The only reliable method for identifying VPN protocol signatures is deep packet inspection (DPI), which analyzes traffic at the network level, not system- or app-level. China's Great Firewall and Russia's TSPU system use DPI via ISPs, but a website operator cannot implement this because it requires access to network infrastructure that sits between the user and the server, not on the server itself.

Impact on Non-Technical Users

Setting up a personal WireGuard instance on any major cloud provider takes minutes, meaning the law will likely have a more significant impact on non-technical users who rely on commercial VPN services for legitimate privacy reasons. These users include journalists, people living under authoritarian regimes, political dissidents, and abuse survivors, among others.

Broader Legislative Trends

Utah is not alone in attempting to legislate the impossible. In the UK, the House of Lords — Parliament’s secondary chamber — voted 207-159 in January to ban VPN services for under 18s, with those amendments now due to be debated in the House of Commons. VPN use jumped by more than 1,400% on the first day of age verification enforcement in July last year. Meanwhile, France’s digital affairs minister, Anne Le Hénanff, has stated that VPNs are “next on my list.” Wisconsin considered similar provisions earlier this year but scrapped them due to heavy backlash.

Authoritarian Regimes and VPN Blocking

To date, the only countries that have made progress in blocking VPN traffic with some success are authoritarian regimes with ISP-level surveillance. These governments have the infrastructure and control necessary to enforce such measures effectively.

Conclusion

As the debate over online age verification and the role of VPNs continues, the challenges posed by these laws remain complex and multifaceted. The need for effective and fair solutions that protect both users and websites is more critical than ever.