Federal Court Blocks Utah VPN Law, Backs EFF

A federal district court has issued a preliminary injunction halting enforcement of the VPN-related provisions of SB 73, an age-verification law enacted in Utah. The Electronic Frontier Foundation (EFF) disclosed this in a blog post published in October 2026, and according to Slashdot’s EditorDavid, EFF frames it as a victory for digital rights.

At the start of its blog post, EFF addressed legislative interference in the design of the internet and the role of the judiciary as follows:

When state lawmakers try to rewrite how the internet works, users rely on courts to recognize that legislation cannot make technical impossibility a reality.

This ruling is the first clear judicial check on a state law that makes the use of privacy-protecting technology itself a target of regulation.

What SB 73’s VPN Rules Required

SB 73 is a state law enacted earlier this year that states its purpose as regulating adult sites. According to EFF, the law required adult sites either to block VPN users or to determine the physical location of visitors using VPNs or similar communications-concealment tools.

The law also prohibited sites from providing guidance on how to use VPNs to evade age verification. As far as EFF is aware, it is the first state law in the country to directly target the use of VPNs to evade age verification.

The structure of the requirement is not simple. It compels site operators to build a system that determines both a visitor’s location and age without knowing who the visitor is.

The Basis for the Federal Court’s

Unconstitutionality Ruling

A federal district court in Utah last week halted enforcement of the law’s VPN provisions. The ruling found that the law likely violates constraints in the U.S. Constitution. At issue was the principle barring legislation that imposes significant burdens on out-of-state businesses and individuals.

According to EFF’s article, the court noted the following about the law’s location provisions:

In practice, the provisions concerning actual location require operators to implement age-verification services for every user who visits the site from anywhere. If even one user is concealing their communications, the operator would be in violation of the law.

This logic means that all users outside Utah would in effect be subject to Utah law. The court also indicated its view that less burdensome alternatives exist for keeping Utah minors away from adult sites.

Requirements Deemed Technically Impossible

Central to the dispute is whether a mechanism to detect and block concealed communications can actually be built with real-world technology. Geolocating users from IP addresses is imprecise, and misjudgments are unavoidable when mobile communications and shared addresses are involved.

Attempting to detect and exclude traffic routed through VPNs and similar tools would sweep in large numbers of users who use encrypted communications for legitimate reasons. The result would be a design that imposes age verification on every visitor worldwide.

EFF argues that forcing platforms to detect and block privacy-protecting tools imposes an impossible requirement while undermining the privacy and security of users around the world. The argument is that the requirement is inconsistent both legally and technically and operationally.

Problems with ID-Based Age Verification

In an email sent this week, EFF raised another issue: age-verification laws assume that users possess identification documents.

According to the organization, millions of people worldwide lack government-issued ID or face routine difficulties obtaining or renewing it. Verification methods that presuppose ID would exclude these groups from services. The problem is not confined to any particular country or region.

In exchange for stricter age verification, a structure also emerges in which users’ identity-verification information is centralized. EFF has consistently pointed out that expanding identification infrastructure in the name of safety can go hand in hand with normalized surveillance.

The Dangerous Pattern Shared with

Site-Blocking Laws

Alongside this case, EFF also referred to site-blocking laws aimed at copyright enforcement. According to the organization, the idea of building mechanisms for blocking access to entire websites into the architecture of the internet invariably invites deliberate abuse and broad collateral damage to lawful expression.

There are no technical means to precisely define what should be blocked, and the more operational discretion expands, the more room there is for abuse. EFF sees this pattern as common to age-verification laws and site-blocking laws. It is a design problem in which regulations that operate across state borders are shifted onto operators as implementation responsibilities.

The Opt Out October Initiative

EFF has designated this month “Opt Out October” and is publishing daily guides on privacy-protecting settings and tools. They focus on practical information for distancing oneself from tracking and profiling.

This reflects an approach of pursuing legal challenges to regulations and offering self-defense measures for users in parallel. The activity of working to improve user literacy, rather than merely waiting for judicial decisions, is consistent with the organization’s traditional approach.

Age-Verification Legislation Also

Advancing in Japan

In Japan, too, how age verification should work for youth protection remains an ongoing issue. A design that requires sites to verify identity poses the same kind of challenge as SB 73 in that it imposes similar burdens on providers, including overseas operators.

Efforts to build systems that handle age information on devices and operating systems are attracting attention as an option for avoiding the technical impossibility of site-by-site verification. However, the question of where to place the entity managing age information remains. The editorial team believes that merely shifting the locus of verification duties from operators to the platform layer will not solve the fundamental problem of centralized identity information.

Editorial Opinion

In the short term, if Utah appeals, the dispute will drag on. We believe that when other states design similar age-verification laws, moves to remove VPN provisions may accelerate. Operators will be able to avoid implementing location determination.

In the medium to long term, we assess that the main battleground for age verification will shift from sites to operating systems and devices. The focus will be on designing age assurance that does not depend on ID documents, which will likely encourage standardization of privacy-protecting technologies. Pressure to monitor VPN providers will remain.

As questions from the editorial team: Should location determination based on IP addresses and device information be a premise of law enforcement? Will pushing age assurance onto operator responsibility normalize the tracking of individuals? Japan cannot avoid the same debate.

References

• “Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility”, by EditorDavid — Slashdot, 2026-10-17T22:00:00.000Z (ARR)
• Source URL: https://yro.slashdot.org/story/26/10/17/2153207/court-agrees-with-eff-utahs-vpn-law-demands-a-technical-impossibility?utm_source=rss1.0mainlinkanon&utm_medium=feed