Governments around the world, including dozens of U.S. states, have increasingly passed laws requiring some form of age verification to access certain types of online content, usually pornography. Australia has even gone as far as banning social media for teens under 16, while countries like Spain, Indonesia, and Malaysia are considering similar restrictions.
But as these laws continue to spread, so has a simple workaround: virtual private networks, or VPNs.
Now, Utah is the first state in the U.S. to officially try to close that loophole. On Wednesday, a new law known as the Online Age Verification Amendments will go into effect in the state, and privacy advocates are not happy about it.
“Attacks on VPNs are, at their core, attacks on the tools that enable digital privacy. Utah is setting a precedent that prioritizes government control over the fundamental architecture of a private and secure internet, and it won’t stop at the state’s borders,” the Electronic Frontier Foundation (EFF) wrote in a post last week about the law.
The new law adds two new restrictions related to VPNs.
First, the law states that a person is considered to be accessing a website from Utah if they are physically located in the state, regardless of whether they use a VPN or any other method to hide their location.
The EFF warns that holding companies liable for verifying the age of users in Utah, including those using VPNs, is technically unrealistic because websites generally cannot reliably determine a VPN user’s actual location. According to the group, that could force websites to either “ban all known VPN IPs, or to mandate age verification for every visitor globally.”
And even that may not work very well as VPN providers constantly add new IP addresses, making it virtually impossible to comprehensively block all VPN traffic.
Still, details on how the law will be enforced remain murky since websites are only expected to act if they become aware that a person physically located in Utah is accessing the site through a VPN.
Additionally, the law also states that websites hosting “a substantial portion of material harmful to minors” are prohibited from encouraging the use of VPNs.
“This raises significant First Amendment concerns, as it prevents platforms from providing basic, truthful information about a lawful privacy tool to their users,” the EFF wrote.
The law is unprecedented in the internet’s new age-verification era, but privacy advocates worry it could also become a model for lawmakers elsewhere looking to crack down on VPNs and other tools used to bypass online restrictions.
Last year, a U.K. government official also called for tougher rules to stop children from using VPNs to get around the country’s online safety laws.
