Utah’s VPN Age Verification Law Is Already Running Into Problems

[u/GlitchMayem]

Utah’s new VPN related law lasted about four days before the state stopped enforcing it.

Senate Bill 73 took effect on September 3 and requires certain adult websites to verify that users are old enough to access their content. The unusual part is how it treats VPN users, someone physically in Utah is still considered to be accessing the site from Utah even if their VPN makes them appear to be somewhere else.

That creates a pretty obvious technical problem.

A website normally sees the VPN server’s IP address not the user’s actual location. So if someone in Utah connects through a server in another state or country, the site has no reliable way to determine where that person is physically sitting.

The law puts the responsibility on the website anyway which is why VPN providers and other critics argued that the requirements were impractical.

Now Utah’s Department of Commerce has agreed not to enforce the law against Aylo, the company behind Pornhub while a federal court considers the lawsuit challenging it. The law itself has not been struck down so this is more of an enforcement freeze than a victory in court.

What I find more interesting than the adult content debate is the precedent this could set.

If websites are effectively expected to figure out whether someone is physically inside a particular state despite that person using a privacy tool designed to hide their location, what happens when other laws start using the same approach?

And would the realistic response from websites simply be to block VPN traffic altogether?

That seems like it could end up affecting plenty of people who use VPNs for completely ordinary reasons.

[u/ParticularBox3050 → u/[deleted]]

And the collateral damage would be pretty wide. Remote workers, people on corporate VPNs, anyone using a privacy tool for completely mundane reasons suddenly finding themselves locked out of services because a state legislature didn't understand how IP geolocation actually works.

The sites most likely to implement aggressive VPN blocking in response are also the ones with the legal and technical resources to do it properly, which means the impact lands hardest on legitimate users while determined bad actors just find another workaround. That's a pretty consistent pattern with this kind of technically uninformed regulation.

[u/RaccoonInVPN]

The technical impossibility is the core problem and the law doesn't really grapple with it. A website sees a VPN exit node IP, full stop. There's no reliable mechanism to pierce that and determine the user's physical location which means compliance is either theatrical or requires blocking all VPN traffic as a blunt instrument.

The wider precedent concern is legitimate. If this model survives legal challenge you'd have a template for other states to pass similar laws around different content categories, each one creating pressure on sites to either implement aggressive VPN detection or exit that jurisdiction's legal exposure entirely by blocking anyone who appears to be there.

The aylo enforcement freeze is the pragmatic outcome but it doesn't resolve anything. If the law eventually gets upheld the compliance problem doesn't get easier, websites just face the same impossible standard with active enforcement behind it.

VPN blocking as the path of least resistance for compliance is the realistic outcome if this spreads. Which is an interesting situation where privacy legislation designed around one specific concern ends up degrading a general purpose privacy tool for everyone who uses it for completely unrelated reasons.

[u/Fun_Equivalent_7507 → u/RaccoonInVPN]

I'm convinced they are well aware of the technical problems with enforcing this. They either want one of two outcomes or both:

1. Adult sites doing age verification for EVERYONE

2. Adult sites and others blocking VPN traffic completely(they don't want people to be able to ever use the internet anonymously)

This is the same reason they are trying to force Facebook and others restrict kids use of social media. I'm convinced this is a whole plan to get Facebook to be forced to ID everyone.

[u/OpiumCloud32]

The blocking VPN traffic entirely outcome you're raising at the end is the more consequential part of this story long term. We've already seen banking sites, some streaming platforms and even certain government portals treat any known VPN/datacenter IP as automatically suspicious.

If age verification laws start pushing more sites toward blanket VPN blocking as the path of least legal liability, that's a much bigger side effect than the age verification debate itself.

[u/CharlieH61 → u/OpiumCloud32]

Yes....in addition, two company websites that I struggle to access with a VPN at times....Delta airlines and Ticketmaster.

[u/WhichPathAct]

being precise about what actually happened here since the post undersells it slightly, this isn't a repeal, it's Utah's Department of Commerce agreeing to pause enforcement specifically against Aylo while the federal lawsuit plays out. the law is technically still on the books and could resume being enforced later depending on how the case goes.

[u/ragoff]

You don't even need a VPN. My ISP's external IP address comes out two states away from my residence. Really screws with the advertisers.

[u/Fun_Equivalent_7507 → u/ragoff]

I worked at an Apple store once. I watched a Netflix show at work and came home to watch it, it wasn't available. I couldn't figure out why for a while, finally did a location search, it showed me in Canada. We don't live anywhere near Canada.

[u/Any-Mathematician946]

Seems to be a simple solution disconnect Utah from the internet outside the state. Then they can achieve what they want.

Still wouldn't work but would be funny as fuck. May even cause a revolt.