Federal Court Slaps Down Utah’s VPN Restrictions

As I write, I have my virtual private network (VPN) set to show me as surfing the internet from Berlin, Germany, despite my location in Arizona, for no good reason other than that I can. Given that Germany has rather tight restrictions on speech, this is probably the reverse of how a VPN is usually used between the two countries, but it illustrates the utility of technology that anonymizes internet traffic and lets users pick their points of origin to bypass censorship and surveillance. Germans can bypass controls on “hate speech” and insults directed at politicians, the Chinese can work around restrictions on Winnie the Pooh memes, and people in places like Utah can ignore intrusive age-verification rules.

That’s why it’s important that a federal court just paused enforcement of Utah’s effort to regulate VPNs.

Utah Pushes Age Verification and Targets VPNs

“Signed into law earlier this year, SB 73 attempted to regulate adult websites by requiring them to block VPN users or to identify the physical location of visitors using them or similar tools that mask their network traffic,” the Electronic Frontier Foundation’s (EFF) Rindala Alajaji details in a response to the case. “It even went so far as to prohibit websites from offering instructions on how to use a VPN to bypass these checks. This made Utah, to EFF’s knowledge, the first state in the nation to target the use of VPNs to avoid legally mandated age-verification gates.”

Utah was sued over the law by Aylo Freesites Ltd. and Aylo Group Ltd., the owners of Pornhub. The plaintiffs didn’t challenge the law’s age-verification requirements but went after its insistence that the law applies if a user is “actually located” in Utah without regard to the use of “a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”

Utah’s focus on VPNs and similar tools comes after decades of technological innovation intended to allow internet users to bypass censorship, firewalls, and surveillance imposed by authoritarian regimes that want to monitor and muzzle dissidents. VPNs, perhaps the most popular of the tools, route internet traffic through intermediary servers, encrypting data in the process and concealing users’ locations. That’s extremely handy for people suffering under oppressive rule. In recent years, though, speech restrictions have been increasingly imposed by nominally liberal democratic governments.

VPNs: Once Championed and Now Resented by Nominally Free Governments

“Dramatic erosions of freedom of expression in democracies are not isolated events,” the Vanderbilt University-based Future of Free Speech think tank detailed in its 2023 report, The Free Speech Recession Hits Home. “They are part of a broader and global free speech recession that has afflicted the heartland of free expression in open democracies, and which threatens to roll back hard-won freedoms.”

Officials of the offending governments have discovered that tools effective for bypassing Chinese and Iranian censorship are equally useful for evading restrictive laws imposed by the European Union, Brazil, or Utah. Britain briefly considered targeting VPNs but dropped the idea amid pushback and after discussions about the daunting challenge of banning technology designed to be unbannable.

Targeting VPNs Violates Constitutional Protections for Interstate Commerce

In their lawsuit, the plaintiffs complained that the state’s requirements that age verification be applied to all internet users present in Utah even if they use technological tools to disguise their location would require them “to age-verify every user of its platforms throughout the world” on the off-chance that they’re Utah residents pretending to be inhabitants of a jurisdiction that imposes no age rules. They claimed, “this violates constitutional principles regarding extraterritorial regulation, the dormant Interstate Commerce Clause, and the dormant Foreign Commerce Clause.”

In their response, Utah’s attorneys insisted that the law may read that way, but that “the statute demands not perfection but reasonable efforts to determine whether a user is actually located in Utah.”

The problem for the defendants, Judge David Barlow of the U.S. District Court for the District of Utah pointed out, is that “the statute says nothing about reasonableness in geolocation efforts,” and the Utah Attorney General’s assurances of moderate enforcement run counter to the letter of the law.

“Read together with the age verification statute as a whole, the actual-location amendment requires entities like Aylo to geolocate its website users with perfection to avoid liability,” Barlow added. “It is undisputed that geolocation perfection is not presently possible.”

Barlow also wrote that “because the amendment requires an unattainable perfection in geolocation, its primary effect will be to burden interstate commerce outside of Utah.” As a result, “the actual-location provision’s burden on interstate commerce is heavy.”

“All in all,” he concluded, “Aylo has shown it is substantially likely to succeed on the merits of its claims that the actual-location provision facially violates the United States Constitution’s dormant Commerce Clause.”

Having found the “actually located” requirements of the law likely unconstitutional, the court didn’t even move on to the foreign commerce issue. Barlow issued a preliminary injunction against enforcement of the “actually located” provision of the law that went after VPNs.

An Ongoing Fight To Protect the Pro-Liberty Online Tools

“EFF welcomes Judge Barlow’s ruling, which recognizes the fundamental disconnect between state legislation of the internet and how technology works,” wrote EFF’s Alajaji. “In his ruling, Judge Barlow noted that the statute requires a technical impossibility on pain of legal liability.”

Alajaji added that if governments insist on targeting security tools like VPNs, “VPN services and obfuscation tools will simply adapt, making this framework fundamentally unsustainable. As we’ve said time and time again: the internet will always route around censorship.”

Even before the injunction was issued, as the court mulled the case, Fight for the Future, a group that sees technology as a liberating force, hosted its second annual Defend VPNs Day of Action on September 25. According to the organization, “the Day of Action underscores how seriously VPN users and providers are taking not only outright VPN restrictions and bans, but also the draconian censorship laws that often precede them.”

Fight for the Future vows to “host the Defend VPNs Day of Action annually for as long as VPNs are under attack.”

Given the increasingly authoritarian treatment of speech by even supposedly open governments, those pro-VPN protests may be regular events for a long time to come. At least for now, though, they won’t be a pressing concern in Utah or (fingers crossed) the rest of the U.S.