If you use a VPN to keep your browsing private or access certain websites, there is a good chance things are about to get inconsistent. Starting May 6, a new law in Utah could push websites to block VPN users altogether.
The state just passed a law targeting how people bypass age-verification systems on commercial sites that host content deemed “harmful to minors.” It doesn’t ban VPNs outright. But by making websites responsible for figuring out where you really are, even if you are using a VPN to hide it.
The core problem lies in websites being told to verify users’ location, enforce age checks for Utah residents, and take legal responsibility if they get it wrong. But VPNs are designed to hide your location. So now, websites are stuck in a weird position: trust VPN users and risk breaking the law or block them completely to stay safe.
Guess which one is easier?
So, if a site cannot confidently tell whether you are in Utah, it might just block VPN traffic entirely.
And it gets weirder: the law actually prohibits these websites from “encouraging” or providing instructions on how to use a VPN to bypass their age gates. So, if you were hoping for a “How-To” guide on a site’s help page to help you regain access, you’re out of luck. The rules effectively muzzle the platforms, making sure they don’t help you find a way around the digital fence.
The “liability trap” effect
Instead of trying to detect VPN users accurately (which is basically impossible at scale), websites might block known VPN IP addresses, require age verification for everyone, or just deny access entirely.
Blocking VPNs sounds simple, but it’s not. VPN providers constantly rotate IP addresses, and new ones show up all the time. There’s no perfect list. So it turns into a game of whack-a-mole, with sites blocking known VPNs, new ones appearing, and users switching tools. And the cycle repeats.
Meanwhile, regular users get caught in the middle. Of course, the ones to be affected the most will be businesses, journalists, and abuse survivors. Basically, the data privacy of every Utah resident is impacted.
But there is a world where this could spread beyond one state. Even though this starts in Utah, the ripple effect could be bigger.
We’ve already seen similar policies pop up in places like the UK and Australia, usually tied to age verification laws.
So, if you start noticing sites loading differently when you use VPN, access getting blocked, or even more prompts asking you to verify your age, know that the rules have changed.
Source: EFF