- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,551
The law requires you to find a person for a VPN, although VPN is just for this.
Utah decided to close the loophole in the check of age and immediately stumbled upon the device of the Internet. A visitor can sit in Salt Lake City, open a website through a VPN with an address in another country, and the resource owner should still be responsible for checking the age. For the U.S., this approach will be the first direct blow to VPNs in laws on access of minors to online content.
The Online Age Verification Amendments, formally Senate Bill 73, comes into force on May 6. The law was signed by Utah Governor Spencer Cox on March 19. The document considers the user a visitor from Utah, if a person is physically in the state, even when connected via a VPN or proxy, hiding a real IP address.
Sites that fall under the law are forbidden not only to allow minors to materials harmful to children, but also to explain how to bypass the age check with VPN. There is no direct ban on the use of VPN in the text, but the responsibility is shifted to the owners of the sites: the resource must understand that behind the hidden address is a visitor from Utah, and demand proof of age.
NordVPN called the law a “unsolved paradox of compliance” and a “travel of responsibility.” The logic of critics are simple: the VPN is created to hide the location, and the law requires the site to recognize the user who specifically hides the geography of the connection. The Electronic Frontier Foundation warns that resource owners can choose the safest legal path: block known VPN addresses or require age verification from all visitors in the world.
The technical problem is not related to one IP address base. Services like MaxMind and IP2Proxy can mark some of the traffic from data centers, but commercial VPN providers are constantly changing addresses, and resident VPN nodes look almost like regular home connections. Analysis of offline systems helps to notice traffic from hosting service networks, but does not distinguish the WireGuard personal tunnel on a cloud server from a regular site on the same infrastructure.
The most reliable VPN signals reveal in-depth packing analysis, or DPI, but this method works at the network level, not an application or site. For example, the Chinese Internet filtering system uses DPI through communication providers because the equipment stands between the user and the server. The usual owner of the site does not have access to this section of the network.
As a result, the law will hit more not technically trained users, but on people who use commercial VPN services to ensure privacy. Journalists, political activists, residents of countries with tight control of the Internet and people who need to hide digital traces for personal security.
Utah is not the only region where age checking begins to catch a VPN. In January, the House of Lords voted 207 against 159 to limit VPN services for users under the age of 18, and the amendments still have to be discussed in the House of Commons. After the launch of age checks in the UK last July, interest in VPNs has risen sharply, and French Digital Secretary Anne Le Anno said that VPNs are next on her list.
Wisconsin at the beginning of the year considered similar provisions, but refused them after sharp criticism. So far, noticeable success in blocking VPNs are achieved mainly in countries where the state controls traffic at the level of providers, and not individual sites trying to guess the real location of the visitor on an incoming request.
Utah decided to close the loophole in the check of age and immediately stumbled upon the device of the Internet. A visitor can sit in Salt Lake City, open a website through a VPN with an address in another country, and the resource owner should still be responsible for checking the age. For the U.S., this approach will be the first direct blow to VPNs in laws on access of minors to online content.
The Online Age Verification Amendments, formally Senate Bill 73, comes into force on May 6. The law was signed by Utah Governor Spencer Cox on March 19. The document considers the user a visitor from Utah, if a person is physically in the state, even when connected via a VPN or proxy, hiding a real IP address.
Sites that fall under the law are forbidden not only to allow minors to materials harmful to children, but also to explain how to bypass the age check with VPN. There is no direct ban on the use of VPN in the text, but the responsibility is shifted to the owners of the sites: the resource must understand that behind the hidden address is a visitor from Utah, and demand proof of age.
NordVPN called the law a “unsolved paradox of compliance” and a “travel of responsibility.” The logic of critics are simple: the VPN is created to hide the location, and the law requires the site to recognize the user who specifically hides the geography of the connection. The Electronic Frontier Foundation warns that resource owners can choose the safest legal path: block known VPN addresses or require age verification from all visitors in the world.
The technical problem is not related to one IP address base. Services like MaxMind and IP2Proxy can mark some of the traffic from data centers, but commercial VPN providers are constantly changing addresses, and resident VPN nodes look almost like regular home connections. Analysis of offline systems helps to notice traffic from hosting service networks, but does not distinguish the WireGuard personal tunnel on a cloud server from a regular site on the same infrastructure.
The most reliable VPN signals reveal in-depth packing analysis, or DPI, but this method works at the network level, not an application or site. For example, the Chinese Internet filtering system uses DPI through communication providers because the equipment stands between the user and the server. The usual owner of the site does not have access to this section of the network.
As a result, the law will hit more not technically trained users, but on people who use commercial VPN services to ensure privacy. Journalists, political activists, residents of countries with tight control of the Internet and people who need to hide digital traces for personal security.
Utah is not the only region where age checking begins to catch a VPN. In January, the House of Lords voted 207 against 159 to limit VPN services for users under the age of 18, and the amendments still have to be discussed in the House of Commons. After the launch of age checks in the UK last July, interest in VPNs has risen sharply, and French Digital Secretary Anne Le Anno said that VPNs are next on her list.
Wisconsin at the beginning of the year considered similar provisions, but refused them after sharp criticism. So far, noticeable success in blocking VPNs are achieved mainly in countries where the state controls traffic at the level of providers, and not individual sites trying to guess the real location of the visitor on an incoming request.
