Utah Targets VPNs for Age Verification

Governor Spencer Cox has signed a law stating that websites are accountable for determining if a user is physically located in Utah, even from behind a VPN.

The law doesn’t explicitly ban VPNs but it states that anyone physically located in Utah, even if behind a VPN, they must be subject to age verification.

This poses a technical challenge for websites on how they’re supposed to verify someone is physically in Utah.

While not a full ban, it encourages websites to block VPNs since it could pose a legal risk to them in case someone is physically located in Utah.

Even trying to block all VPNs and proxies would be difficult, the EFF describes it as “technical whack-a-mole.” There are plenty of protocols designed to bypass blocking and make traffic look like regular user traffic.

Shadowsocks is widely used in China to bypass the Great Firewall. The MASQUE protocol, and IETF standard, utilizes standard QUIC connections to proxy your connections. Trusttunnel, a newer protocol, disguises your traffic as regular Chrome traffic, among many other privacy features to make your VPN traffic hard to detect.

Not to mention that, even without a VPN, IP address geolocation is extremely unreliable. There‘s nothing inherently tying a particular IP address to a specific location, so websites can often be completely wrong while trying to geolocation you via IP address.

Laws like these are impossible to enforce and put websites in an impossible position.

Instead of admitting that the current approach to age verification is unworkable, lawmakers continue doubling down and trying to close “loopholes” by brute force.

While age verification laws aren’t new, this law sets a dangerous precedent in the US.

VPNs are a target of lawmakers looking to enforce age verification because they can make you look like you’re somewhere you’re not.

When you connect to a website via a VPN, the site will see the IP address of your VPN server and not your real IP address assigned to you by your Internet Service Provider.

Many sites decide whether they will perform age verification based on where the IP address connecting to them appears to be, so VPNs can be an effective method of bypassing these restrictions.

They’re also commonly used tools to protect the privacy of their users. This law threatens VPN users as a whole because websites will now need to be suspicious of all VPN traffic in case some of those users are physically located in Utah.