Utah wanted platforms to spy on how you connect to the internet. Not content with basic age verification requirements, the state passed SB 73, a law that would have forced websites to detect when users were accessing their services through a VPN and then block them. A federal judge just said no. And the reasoning behind that decision is worth paying attention to.
What the law actually required
SB 73 wasn’t just an age verification law. It was an attack on the tools people use to stay private online. The law required platforms to identify VPN traffic and deny access to users who appeared to be masking their location or identity. For anyone who cares about privacy, that framing should raise immediate red flags. The law effectively treated VPN use as suspicious behavior, something to be detected and punished, rather than a legitimate privacy choice made by millions of people every day.
Why the court agreed it was unworkable
According to the Electronic Frontier Foundation, the federal judge issued a preliminary injunction blocking the law after EFF submitted detailed comments to the Utah Department of Commerce explaining that what SB 73 demanded was technically impossible. You cannot reliably detect all VPN traffic. The methods used to identify VPNs are imprecise, easily circumvented, and would cause significant collateral damage. Blocking VPN users means blocking journalists in hostile countries, corporate employees on work networks, privacy-conscious individuals, and anyone using a shared IP address.
The broader implications for online privacy
This ruling matters because Utah is not alone. Several U.S. states have passed or are considering similar laws that bundle age verification requirements with obligations that essentially force platforms to surveil user behavior at the network level. That’s a pattern worth watching. Each of these laws chips away at the technical infrastructure that makes private internet use possible.
- VPNs are legal tools used by millions for legitimate privacy and security reasons
- Mandating VPN detection creates pressure for deeper packet inspection and network surveillance
- Inaccurate detection methods harm users who are not the intended targets of the law
- Compliance obligations get exported globally when large platforms must meet them
So a court blocking one state law is a win, but it’s a narrow one. Legislatures keep trying. And each new bill tests how far courts, and users, will let them go before someone pushes back hard enough to matter.