Utah’s Online Age Verification Amendments, formally Senate Bill 73, take effect on May 6, making the state the first in the U.S. to explicitly target VPN use as part of age verification legislation.
Signed by Governor Spencer Cox on March 19, the controversial law establishes that a user is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN or proxy to mask their IP address. It also prohibits covered websites from sharing instructions on how to use a VPN to bypass age checks.
The law is also technically flawed, given that it assumes that a web provider can reliably detect VPN traffic and determine a user’s true physical location — they can’t. IP reputation databases such as MaxMind and IP2Proxy can flag traffic from known datacenter IP ranges, but commercial VPN providers rotate addresses constantly, and residential VPN endpoints are largely indistinguishable from standard home connections. Autonomous System Number analysis can catch traffic originating from datacenter networks, but can’t identify a personal WireGuard tunnel running on a cloud VPS, for example, which routes through the same infrastructure as ordinary web hosting.
Follow Tom’s Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
[ad_2]
Source link
More on utah first state to hold websites
Stay tuned for updates on utah first state to hold websites as the story develops. Related: Measles surge in Utah sparks fears US could undo decades of progress and jeopardize elimination status.
Frequently Asked Questions
Senate Bill 73, formally called the Online Age Verification Amendments, is a Utah law signed by Governor Spencer Cox on March 19 that takes effect on May 6, making Utah the first U.S. state to explicitly target VPN use in age verification legislation.
The law establishes that a user is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN or proxy to mask their IP address.
NordVPN called the law an unresolvable compliance paradox and a liability trap, arguing it holds websites responsible for identifying users whose tools are specifically designed to be unidentifiable.
Critics argue websites cannot reliably detect VPN traffic or determine a user's true physical location, since commercial VPNs rotate addresses constantly, residential VPN endpoints look like normal home connections, and reliable detection requires deep packet inspection that only ISPs can perform.
