Court Blocks Utah VPN Age-Verification Law, Citing Likely Constitutional Burden

A federal judge has temporarily blocked enforcement of Utah’s SB 73 provisions targeting VPN use, finding the law likely burdens people and businesses beyond the state. The Electronic Frontier Foundation says the requirements threaten privacy and demand technical steps websites cannot reliably perform.

Slashdot has reported:

A federal judge has issued a preliminary injunction blocking Utah from enforcing the VPN provisions of SB 73, the state’s age-verification law for adult websites. The court ruled last week that the provisions likely violate the U.S. Constitution’s prohibition on state laws that significantly burden businesses and people outside the state’s borders.

Signed into law earlier this year, SB 73 sought to regulate adult websites by requiring them to block users of virtual private networks, or VPNs, or identify the physical location of visitors using VPNs and similar tools that obscure network traffic. The law also barred websites from providing instructions on how to use a VPN to bypass the checks. The Electronic Frontier Foundation, or EFF, said that, to its knowledge, Utah was the first state in the country to target VPN use for avoiding legally required age-verification gates.

The requirements affect users beyond Utah because websites would have to determine every visitor’s physical location and block those in Utah, or verify the age of every visitor in case that person might be in the state. The court wrote that the law’s “actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating.”

The court’s decision effectively found that Utah has less burdensome ways to prevent minors in the state from accessing adult websites than requiring all internet users worldwide to comply with SB 73. The injunction is preliminary, and the ruling described the law as likely unconstitutional.

In a blog post, EFF said, “When state lawmakers attempt to rewrite how the internet works,” users rely on courts to recognize that laws cannot make technical impossibilities a reality. The group added, “That's why we were happy to see that a court has blocked Utah's attempt to outlaw the privacy protections of Virtual Private Networks (VPNs).”

EFF argued that requiring platforms to detect and block privacy tools threatens users beyond Utah. Its position is that “forcing platforms to detect and block privacy-preserving tools undermines user privacy and security worldwide while demanding the impossible.”

The group also raised concerns about age-verification laws that rely on identity documents. In an email this week, EFF said, “Age verification laws that are predicated on users possessing identity documents exclude critical sections of populations.” It added that the problem is global, with millions of people lacking government-issued identification or regularly facing challenges obtaining or updating it.

EFF’s discussion also linked the Utah case to broader concerns about website-blocking proposals. The group said bills of this kind rely on the idea that copyright enforcement requires building website censorship into the internet’s architecture. It argued that no mechanism for blocking access to an entire website avoids the risks of deliberate abuse and collateral harm to free and lawful speech.

EFF has declared this month “Opt Out October.” Each day, it is offering new guides on how to “stand our ground and take control over what happens with our data.”