Court agrees with EFF: Utah's VPN law demands a technical impossibility

A federal judge has blocked Utah's draconian anti-VPN age verification law, SB 73, in a victory for digital rights. The Utah State Legislature attempted to rewrite how the internet works by requiring adult websites to detect and block VPN users or identify the physical location of visitors using them. However, a federal court has ruled that the law likely violates the U.S. Constitution's prohibition on passing laws that significantly burden businesses and people outside Utah's borders.

The court found that SB 73 demands a technical impossibility, as it would require platforms to perform age verification services for every user visiting their site from any location, as even one user obfuscating their location would result in non-compliance. The ruling acknowledges the fundamental disconnect between state legislation and technology, as VPNs protect user privacy by routing web traffic through intermediary servers, making it impossible for destination websites to determine the user's actual location.

The court emphasized that geolocation perfection is not currently possible, and the administrative rules drafted by the state further exacerbated the issue by compelling commercial entities to implement invasive data collection regimes. The decision allows the Utah Department of Commerce to finalize the administrative rules, which could become effective as soon as October 8, 2026.