Utah Becomes First US State to Hold Websites Liable Over VPN-Based Age Checks
Published
Key Takeaways
- Utah age verification VPN liability law: Websites held responsible when users bypass age checks using VPN location masking.
- Enforcement difficulty: VPN detection remains unreliable, as traffic often mimics normal internet connections.
- Global policy trend: Other countries explore VPN restrictions and stricter age verification for online platforms.
Utah has introduced a new law that holds websites responsible if users bypass age verification using VPNs. The Online Age Verification Amendments, also known as Senate Bill 73, went into effect on May 6 after being signed by Governor Spencer Cox on March 19. The goal is to stop minors from using VPNs to get around content restrictions.
Location Rules Shift Responsibility to Websites
Under the law, a user’s location is based on where they are physically located, not the location shown by their internet connection. This means even if a VPN hides a user’s real location, websites can still be held liable.
The law also prevents platforms from explaining how VPNs can be used to bypass age checks. Utah’s approach follows earlier proposals in other US states that were later dropped, but this version survived and is now active.
Enforcement Challenges and Technical Limits
Digital rights groups and VPN providers say the law is difficult to enforce in practice. The Electronic Frontier Foundation has called it a “technical whack-a-mole,” noting there is no stable way to track or block VPN IP addresses.
VPN traffic is also hard to distinguish from normal internet use, especially when residential connections are involved. Experts say only deep packet inspection can reliably identify VPN usage, but that requires infrastructure-level control that most websites do not have.
VPN provider NordVPN has criticized the law, calling it a “liability trap” that could affect privacy-focused users like journalists and people in sensitive situations.
Broader Impact and Global Trend
Because enforcement is unclear, websites may respond by blocking VPN users entirely or requiring stricter age checks for everyone. This could increase the amount of personal data collected from users.
Utah is also part of a wider global shift. The UK is considering limits on VPN use for minors, France has discussed future restrictions, and Australia already has age verification rules, though with criticism over effectiveness.
The debate continues between protecting minors online and preserving internet privacy. Utah is currently the first US state to test this approach, and its outcome may influence future laws elsewhere.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular