Utah law now bans porn viewers from using VPNs

A Utah law, enacted Wednesday, seeks to ban the use of VPNs to access porn sites.

The statute is part of SB 73, which contains amendments to the state's age-verification law. These laws typically require some proof of age to access adult content (or any content the state deems "harmful to minors").

Utah's age-verification law, SB 287, went into effect in 2023; it requires age verification via a digital ID card, a third-party verification service, or a credit card.

Pornhub promptly blocked users in Utah as the law went into effect.

Age verification often doesn't work because it can be circumvented. Virtual Private Networks (VPNs), which mask a user's real location, are one popular method for doing that. That's what the Utah law aims to tackle when it says porn sites must not allow VPN usage. Here's the relevant language:

A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements, including by providing: (a)instructions on how to use a virtual private network or proxy server to access the website; or (b) means for individuals in this state to circumvent geofencing or blocking.

"Utah just became the first state in the U.S. to target VPN usage, and they are embarrassing themselves," said Lia Holland, campaigns and communications director at digital rights advocacy group Fight for the Future, in a statement sent to Mashable.

Holland added that the legal language in question reads like AI slop.

"You cannot require a website doing age verification to determine where someone using a reputable VPN is browsing from — this feat is literally impossible by design for even the best hacker," Holland continued. Websites are left with three choices, Holland said: block everyone using a VPN (which is likely impossible), require every site visitor to verify their age, or censor everything that might fall under Utah's "harmful to minors" standard.

Fight for the Future says it will endorse any lawsuit filed against Utah to overturn this law.

The digital civil liberties nonprofit, Electronic Frontier Foundation (EFF), also criticized SB 73. EFF's associate director of state affairs, Rindala Alajaji, wrote in a blog post published April 30: "These provisions won't stop a tech-savvy teenager, but they certainly will impact the privacy of every regular Utah resident who just wants to keep their data out of the hands of brokers or malicious actors."

Alajaii added: "attacks on VPNs are, at their core, attacks on the tools that enable digital privacy. Utah is setting a precedent that prioritizes government control over the fundamental architecture of a private and secure internet, and it won't stop at the state's borders."

"Protecting kids while preserving freedom is not a new concept," SB 73 sponsor Sen. Calvin Musselman told The Salt Lake Tribune, and compared it to policies about alcohol, tobacco, and gambling. (Alcohol, tobacco, and gambling aren't protected by the First Amendment, however; free speech is.)

SB 73 appears to be the first bill enacted to block VPNs, but another ban has been proposed in Michigan. The UK government is also considering a ban on VPNs for minors.

When speaking with Mashable last year about age-verification, First Amendment experts warned of second-order censorship. The first order is age verification, they explained, but people find workarounds. Second-order censorship means banning the workarounds.