When Utah Banned VPNs: How a Court Stopped a Law That Demanded the Technically Impossible

In 2026, Utah did something no U.S. state had ever done: it passed a law effectively banning VPNs. Not by name — by function. SB 73 required websites to detect users masking their location through VPNs and either block them or determine their actual physical location. Last week, a federal judge said no. The reason? The law demands a technical impossibility.

The ruling is a landmark moment in the ongoing tension between state legislation and the fundamental architecture of the internet. And it exposes a problem that's only going to get worse as lawmakers increasingly try to regulate technologies they don't fully understand.

What Utah's SB 73 Actually Did

Signed into law earlier this year, SB 73 was framed as an age-verification measure for adult websites. But its mechanisms went far beyond verifying ages. The law required platforms to:

• Block any user detected using a VPN or similar traffic-masking tools
• Identify the actual physical location of visitors using obfuscation tools
• Prohibit websites from even offering instructions on how to use a VPN to bypass these checks

On paper, it sounds like a targeted regulation. In practice, it was the first state-level attempt in the U.S. to criminalize the use of VPNs to circumvent legally mandated access controls. And it created an impossible situation for any website that falls under its jurisdiction.

Why Perfect Geolocation Doesn't Exist

Here's the technical reality that Utah lawmakers apparently didn't grasp: VPNs work by routing traffic through intermediary servers. When you connect to a website through a VPN, the website sees the VPN server's IP address — not yours. There is no reliable mechanism to determine where the original connection originated.

The court recognized this. Judge Barlow, who issued the preliminary injunction, wrote that the statute "requires entities like Aylo to geolocate its website users with perfection to avoid liability" while acknowledging that "geolocation perfection is not presently possible."

Utah's proposed compliance rules suggested websites implement "commercially reasonable geolocation obfuscation detection systems." The EFF, which submitted formal comments opposing the rules, pointed out that the detection heuristics suggested — monitoring connection latency, checking device time zones — are notoriously unreliable. They're easily skewed by normal network conditions like CDN routing, satellite internet, or even daylight saving time changes.

The Impossible Choice

Because perfect geolocation is impossible, websites faced a binary choice under SB 73:

• Block all VPN traffic nationwide — cutting off millions of legitimate users who use VPNs for security, privacy, and remote work
• Verify the age of every single visitor globally, just in case one of them might be in Utah using a VPN

The court noted that this would require verifying the location and age of approximately 28 million users — whether in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu — just to ensure compliance with one state's law. That's not regulation. That's a sledgehammer applied to the entire internet's architecture.

The Constitutional Problem

Judge Barlow's ruling rested on a fundamental constitutional principle: states cannot pass laws that significantly burden businesses and people outside their borders. This is the Dormant Commerce Clause in action — the idea that one state can't effectively regulate the entire internet just because its legislators have a particular moral agenda.

The ruling also highlighted a deeper irony. In response to users trying to avoid invasive data collection required by age-verification mandates, SB 73 demanded even greater surveillance of internet users' online activities. The solution to privacy concerns was more surveillance — a pattern that should sound familiar to anyone following the encryption debates of the past decade.

The Broader Pattern: Laws vs. Math

Utah's VPN law isn't an isolated case. It's part of a growing pattern of legislation that demands technical impossibilities:

• Encryption backdoor mandates that would require breaking the mathematical foundations of cryptography
• Age-verification laws that require collecting more sensitive data than the content they're meant to restrict
• Content moderation laws that demand perfect automated classification of human speech
• AI regulation that requires guarantees about systems whose behavior is inherently probabilistic

The common thread is a disconnect between what lawmakers want to be true and what the underlying technology actually permits. You cannot legislate away the properties of TCP/IP. You cannot mandate that VPNs reveal their users' locations without fundamentally breaking what VPNs are. And you cannot demand perfect geolocation when the internet's architecture was deliberately designed to abstract away physical location.

What Happens Next

Utah legislators have indicated they may attempt to revise the law during the next legislative session. But the court's preliminary injunction sets an important precedent: state lawmakers should not weaponize age verification to force dragnet tracking or undermine essential security tools.

Other states are watching. As similar anti-VPN proposals emerge across the country, the EFF has pledged to continue pushing back against technically impossible mandates. The internet, as the EFF noted, will always route around censorship — that's not a bug, it's a design feature baked into the architecture itself.

The broader lesson is one that every technologist, policymaker, and citizen should internalize: you can pass any law you want, but you cannot repeal mathematics. VPNs work because of fundamental properties of network routing. Encryption works because of fundamental properties of number theory. Geolocation is imperfect because of fundamental properties of how the internet abstracts physical location. Legislation that ignores these realities doesn't protect anyone — it just creates compliance theater while eroding the privacy and security of everyone it claims to serve.

Utah's SB 73 may eventually be rewritten, narrowed, or abandoned. But the pattern it represents — lawmakers demanding the technically impossible and courts having to step in — will keep repeating until we build a better bridge between legislative intent and engineering reality. Until then, the courts remain our last line of defense against laws that would break the internet to save it.