Federal Judge Blocks Utah's Anti-VPN Age-Verification Law
A federal judge has paused Utah's SB 73, which required adult sites to block VPN users, ruling it likely violates the Constitution.
Signed into law earlier this year, SB 73 sought to regulate adult websites by requiring them to block users of virtual private networks or to identify the physical location of visitors using VPNs or similar tools that mask network traffic. It also prohibited websites from offering instructions on how to use a VPN to bypass the checks. According to the Electronic Frontier Foundation, which publicized the ruling and opposed the law, Utah was the first state in the country to target VPN use as a way of evading legally mandated age-verification gates. The ruling was reported by Slashdot.
The Utah federal court halted enforcement of the law's VPN provisions last week, finding that the measure likely violates the U.S. Constitution's prohibition on laws that significantly burden businesses and people outside Utah's borders. The law burdens internet users everywhere else, the court reasoned, because it requires adult sites either to know every visitor's physical location and block those in Utah, or to verify every visitor's age in case that visitor happens to be in Utah.
"The actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating," the court wrote, according to the foundation. The court also concluded that Utah has less-burdensome ways to keep minors from reaching adult websites than requiring users worldwide to comply with the state's rules.
The foundation welcomed the order. "When state lawmakers attempt to rewrite how the internet works," it wrote in a blog post, "users rely on courts to recognize that laws can't make technical impossibilities a reality." Its position, it said, is that forcing platforms to detect and block privacy-preserving tools undermines user privacy and security worldwide while demanding the impossible.
The group raised a separate objection in an email this week: age-verification laws that are predicated on users possessing identity documents exclude critical sections of the population. Millions of people lack government-issued identification or encounter regular challenges obtaining or updating it, a problem the group described as global in nature.
The foundation also criticized site-blocking bills more broadly, saying they share a core premise that enforcing copyrights requires building a censorship machine for websites into the architecture of the internet. No mechanism for blocking access to an entire website exists that does not invite deliberate abuse and collateral harm to free and lawful speech, it argued. The group has declared this month "Opt Out October," publishing daily guides on how users can take control of what happens with their data.