(Photo by Jakub Porzycki/NurPhoto via Getty Images)
Utah kids using VPNs to access adult content are set for a rude awakening this week as SB 73 goes into effect to crack down on the practice. However, the law is vague, raising fears it could be used to push controversial age-verification tech to more people.
The Online Age Verification Amendments, which go into effect on May 6, include a provision targeting VPNs and proxy networks that can conceal your location and bypass age-verification laws. Pornhub, for example, has blocked access in several states and countries in protest of the laws, but people can get around it by using a VPN.
Utah’s law tries to close that loophole by barring porn sites operating in the state from recommending VPNs, including posting instructions on how to access them. Those adult sites also need to verify the ages of Utah-based users.
However, one stipulation in the law says the age verification needs to cover users, “regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location to make it appear that the individual is accessing a website from a location outside this state.”
The provision is raising red flags because there’s no surefire way for a website to determine whether a Utah-based user is masking their location with a VPN. The problem gets even more complicated when you consider a porn site could be seeing traffic from known VPN servers for thousands of users based outside of Utah.
Recommended by Our Editors
“If a website cannot reliably detect a VPN user's true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally,” says the Electronic Frontier Foundation, a digital rights group. “This would subject millions of users to invasive identity checks or blocks to their VPN use, regardless of where they actually live."
NordVPN first flagged the issue in March when Utah’s governor signed SB 73, telling TechRadar it’s a “technically unenforceable law.” Even if porn sites were forced to comply, it could subject "millions of users to invasive identity checks [when] they have no legal obligation," it adds.
In practice, it’s possible Utah’s law might simply lead to a murky “‘don't ask, don't tell" style of enforcement, according to the Electronic Frontier Foundation, where porn sites only need to check ages “if they actually learn that a user is physically in Utah and using a VPN.”
Still, the EFF warns that the public is “entering uncharted territory” as some governments consider cracking down on VPN use among minors to enforce age-verification laws. “Utah is setting a precedent that prioritizes government control over the fundamental architecture of a private and secure internet, and it won’t stop at the state’s borders,” the group argues.