Court Agrees with EFF: Utah's VPN Law Demands a Technical Impossibility
Published on 2026-10-17T22:00:00Z
"When state lawmakers attempt to rewrite how the internet works," argues an EFF blog post, "users rely on courts to recognize that laws can't make technical impossibilities a reality." "That's why we were happy to see that a court has blocked Utah's attempt to outlaw the privacy protections of Virtual Private Networks (VPNs)." In a win for digital rights, a federal judge has issued a preliminary injunction blocking Utah's SB 73, the state's draconian anti-VPN age verification law... Signed into law earlier this year, SB 73 attempted to regulate adult websites by requiring them to block VPN users or to identify the physical location of visitors using them or similar tools that mask their network traffic. It even went so far as to prohibit websites from offering instructions on how to use a VPN to bypass these checks. This made Utah, to EFF's knowledge, the first state in the nation to target the use of VPNs to avoid legally mandated age-verification gates. The Utah federal court halted enforcement of the law's VPN provisions last week, ruling that the law likely violates the U.S. Constitution's prohibition on passing laws that significantly burden businesses and people outside Utah's borders. SB 73 burdens the rights of all internet users outside of Utah because it requires adult websites to either know every visiting user's physical location, and then block those in Utah, or to verify every visitor's age just in case they might be in Utah. The law's "actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating," the court wrote. The court essentially ruled that Utah has less-burdensome ways to prevent Utah minors from accessing adult websites than requiring all users in the world to comply with SB 73. EFF's position is that "forcing platforms to detect and block privacy-preserving tools undermines user privacy and security worldwide while demanding the impossible." But there's another problem, explained an EFF email this week. "Age verification laws that are predicated on users possessing identity documents exclude critical sections of populations. And this problem is global in nature: Millions of people lack government-issued identification or encounter regular challenges to obtaining or updating it...." Every site-blocking bill has the same rotten idea at their core: That enforcing copyrights requires building a censorship machine for websites into the architecture of the internet. This is, of course, a disaster for a free and open web. These proposals keep coming, but there is still no way to create a mechanism for blocking access to an entire website that does not invite both deliberate abuse and lots of collateral harm to free and lawful speech. EFF has declared this month "Opt Out October," and each day they're offering new guides on how to "stand our ground and take control over what happens with our data."
Published on 2026-10-17T22:00:00Z
"When state lawmakers attempt to rewrite how the internet works," argues an EFF blog post, "users rely on courts to recognize that laws can't make technical impossibilities a reality." "That's why we were happy to see that a court has blocked Utah's attempt to outlaw the privacy protections of Virtual Private Networks (VPNs)." In a win for digital rights, a federal judge has issued a preliminary injunction blocking Utah's SB 73, the state's draconian anti-VPN age verification law... Signed into law earlier this year, SB 73 attempted to regulate adult websites by requiring them to block VPN users or to identify the physical location of visitors using them or similar tools that mask their network traffic. It even went so far as to prohibit websites from offering instructions on how to use a VPN to bypass these checks. This made Utah, to EFF's knowledge, the first state in the nation to target the use of VPNs to avoid legally mandated age-verification gates. The Utah federal court halted enforcement of the law's VPN provisions last week, ruling that the law likely violates the U.S. Constitution's prohibition on passing laws that significantly burden businesses and people outside Utah's borders. SB 73 burdens the rights of all internet users outside of Utah because it requires adult websites to either know every visiting user's physical location, and then block those in Utah, or to verify every visitor's age just in case they might be in Utah. The law's "actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating," the court wrote. The court essentially ruled that Utah has less-burdensome ways to prevent Utah minors from accessing adult websites than requiring all users in the world to comply with SB 73. EFF's position is that "forcing platforms to detect and block privacy-preserving tools undermines user privacy and security worldwide while demanding the impossible." But there's another problem, explained an EFF email this week. "Age verification laws that are predicated on users possessing identity documents exclude critical sections of populations. And this problem is global in nature: Millions of people lack government-issued identification or encounter regular challenges to obtaining or updating it...." Every site-blocking bill has the same rotten idea at their core: That enforcing copyrights requires building a censorship machine for websites into the architecture of the internet. This is, of course, a disaster for a free and open web. These proposals keep coming, but there is still no way to create a mechanism for blocking access to an entire website that does not invite both deliberate abuse and lots of collateral harm to free and lawful speech. EFF has declared this month "Opt Out October," and each day they're offering new guides on how to "stand our ground and take control over what happens with our data."
Read more of this story at Slashdot.
Comments
Post a Comment