Utah's VPN Law Demands a Technical Impossibility
A federal judge in Utah has blocked SB 73, the state's anti-VPN age verification law, with a preliminary injunction. The ruling is a win for the Electronic Frontier Foundation, which argued that the law demands something websites cannot actually do: determine the physical location of every visitor with perfect accuracy, even when those visitors are using tools specifically designed to hide it [1].
Signed into law earlier this year, SB 73 required adult websites to either block VPN users entirely or identify the physical location of visitors using VPNs and similar privacy tools. It went further than any other US state law by also prohibiting websites from offering instructions on how to use a VPN to bypass age verification checks. To the EFF's knowledge, this made Utah the first state in the nation to target VPN use in the context of age verification [2].
The technical impossibility
The core problem the court identified is simple. VPNs exist to obscure where you are. A website receiving a connection through a VPN cannot reliably determine whether that connection originates from Utah, Texas, or Tokyo. SB 73 required websites to do exactly this, on pain of legal liability.
Judge Barlow wrote that the law "essentially imposes strict liability for entities like it when it comes to determining the location of its websites' users" and "requires entities like Aylo to geolocate its website users with perfection to avoid liability" [3].
The practical consequence is that the law burdens every internet user, not just Utah residents. Because a website cannot know whether a VPN user is in Utah, the only safe compliance strategy is to age-verify every visitor from anywhere in the world, or block all VPN traffic outright. The court found this to be an unconstitutional burden on interstate commerce [4].
Why this matters beyond Utah
VPN usage is not niche. According to estimates, roughly 1.6 billion people worldwide use a VPN regularly, for reasons ranging from corporate remote access to circumventing censorship in authoritarian regimes [5]. A legal framework that treats VPN use as inherently suspicious, or that requires websites to defeat the purpose of VPNs to comply with state law, is incompatible with how the internet actually works.
The EFF filed formal comments with the Utah Department of Commerce opposing the proposed compliance rules (R152-78B), which could have been effective as early as October 8, 2026. Judge Barlow's injunction means the law cannot be enforced pending further court action [6].
The broader pattern
Utah is not alone in trying to legislate age verification. Louisiana, Texas, Mississippi, and several other states have passed laws requiring adult websites to verify visitor ages, typically through government ID checks. Those laws have their own problems, but they at least operate within the boundaries of what websites can technically do. SB 73 crossed a line by attempting to regulate a privacy tool that, by design, makes geolocation impossible.
The court's ruling sends a signal that laws regulating internet infrastructure must account for technical reality. You cannot pass a law that requires perfect geolocation and then punish companies for failing to achieve it. The internet does not work that way, and now a federal judge has put that in writing [7].
Sources:
[1] EFF - Court Agrees with EFF: Utah's VPN Law Demands a Technical Impossibility
[2] EFF - Utah's New Law Regulating VPNs Goes Into Effect Next Week
[3] Court opinion (PDF, Courthouse News)
[4] Yahoo News - Utah federal judge blocks VPN provisions
[5] Hacker News discussion (633 points, 284 comments)
[6] EFF formal comments to Utah Department of Commerce
[7] Utah Governor Cox signs SB 73 into law