Utah's Online Age Verification Amendments, formally Senate Bill 73, take effect on May 6, making the state the first in the U.S. to explicitly target VPN use as part of age verification legislation. Signed by Governor Spencer Cox on March 19, the law establishes that a user is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN or proxy to mask their IP address. It also prohibits covered websites from sharing instructions on how to use a VPN to bypass age checks.
Overview
The law aims to curb online access to restricted content by minors, with violators facing fines and penalties. This move could have far-reaching implications for online services and VPN providers.
What it does
The law requires websites to implement age-gating mechanisms or face liability for serving minors. It assumes that a web provider can reliably detect VPN traffic and determine a user's true physical location, which is technically flawed.
Tradeoffs
IP reputation databases such as MaxMind and IP2Proxy can flag traffic from known datacenter IP ranges, but commercial VPN providers rotate addresses constantly, and residential VPN endpoints are largely indistinguishable from standard home connections. Autonomous System Number analysis can catch traffic originating from datacenter networks, but can't identify a personal WireGuard tunnel running on a cloud VPS.
When to use it
Websites that fail to verify the age of users accessing their content via VPNs may face liability under this law. Online services and VPN providers should be aware of the implications of this legislation.
Bottom line
Utah's age verification law sets a precedent for geolocation enforcement, targeting websites that fail to verify the age of users accessing their content via VPNs. This move could have significant consequences for online services and VPN providers.
The takeaway is that online services and VPN providers should be aware of the implications of Utah's age verification law and take steps to comply with the new regulations. This may involve implementing age-gating mechanisms or taking other measures to verify the age of users accessing their content via VPNs.