Utah to hold websites liable for users who mask their location with VPNs

Senate Bill 73 holds websites liable for users who mask their location. When you purchase through links on our site, we may earn an affiliate commission. Here s how it works. (Image credit: Tom's Hardware) Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Email Share this article 11 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Utah's Online Age Verification Amendments, formally Senate Bill 73, take effect on May 6, making the state the first in the U.S. to explicitly target VPN use as part of age verification legislation. Signed by Governor Spencer Cox on March 19, the controversial law establishes that a user is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN or proxy to mask their IP address. It also prohibits covered websites from sharing instructions on how to use a VPN to bypass age checks. NordVPN has called the law an "unresolvable compliance paradox" and a "liability trap," arguing that it holds websites responsible for identifying users whose tools are specifically designed to be unidentifiable. The EFF warned that the legal risk could push sites to either ban all known VPN IPs or mandate age verification for every visitor globally. You may like California introduces age verification law for all operating systems, including Linux and SteamOS — user age verified during OS account setup GrapheneOS refuses to comply with new age verification laws for operating systems Dutch authorities allegedly seize VPN server without a warrant The law is also technically flawed, given that it assumes that a web provider can reliably detect VPN traffic and determine a user s true physical location — they can t. IP reputation databases such as MaxMind and IP2Proxy can flag traffic from known datacenter IP ranges, but commercial VPN providers rotate addresses constantly, and residential VPN endpoints are largely indistinguishable from standard home connections. Autonomous System Number analysis can catch traffic originating from datacenter networks, but can t identify a personal WireGuard tunnel running on a cloud VPS, for example, which routes through the same infrastructure as ordinary web hosting. The only detection method that reliably identifies VPN protocol signatures is deep packet inspection, which analyzes traffic at the network level, not system- or app-level. China's Great Firewall and Russia's TSPU system deploy DPI via ISPs, but a website operator can t because it requires access to network infrastructure that sits between the user and the server, not on the server itself. Meanwhile, setting up a personal WireGuard instance on any major cloud provider takes minutes, meaning the law will be more likely to negatively impact non-technical users who rely on commercial VPN services for legitimate privacy: journalists, people living under authoritarian regimes, political dissidents, and abuse survivors, among others. Utah isn t alone in trying to legislate the impossible into being. In the UK, the House of Lords — Parliament s secondary chamber — voted 207-159 in January to ban VPN services for under 18s, with those amendments now due to be debated in the House of Commons. VPN use jumped by more than 1,400% on the first day of age verification enforcement in July last year. Meanwhile, France s digital affairs minister, Anne Le H nanff, has said that VPNs are next on my list. Wisconsin considered similar VPN provisions earlier this year but scrapped them due to heavy backlash. To date, the only countries that have made progress in blocking VPN traffic with some success are authoritarian regimes with ISP-level surveillance. Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. Luke JamesSocial Links NavigationContributorLuke James is a freelance writer and journalist. Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory.

Utah to hold websites liable for users who mask their location with VPNs

Key takeaways

More in computer-science