Age-verification laws and VPNs: state tracker

Why age-verification laws affect VPN services

All enacted US state age-verification laws make platforms liable based on where users are located, not where their IP address says they are. A VPN changes a user's apparent IP address — routing their traffic through a server in a different state or country — but it does not change their legal location. Louisiana, Arkansas, Texas, Utah, Virginia, Montana, North Carolina, Indiana, and Florida have all enacted laws requiring age verification before users can access adult content; none of these laws exempt VPN traffic. A Utah user accessing a site through a New York VPN server is still legally in Utah; the platform is still legally required to verify their age.

Beyond this structural risk that applies to every enacted state law, three bills went further and explicitly named VPN services in their text — one enacted (Utah), two proposed and now dead (Michigan and Wisconsin). The explicit provisions vary in their target and severity: Utah targets platforms that publish VPN instructions; Michigan would have targeted ISPs required to block VPN traffic at network level; Wisconsin would have required websites to block all VPN-connected users.

Utah SB 73: the only enacted law with explicit VPN language

Utah SB 73 was signed into law on 19 March 2026. It contains two distinct VPN provisions. First, a "deemed-location" clause: users are legally considered to be in Utah regardless of whether they use a VPN, proxy server, or other means to mask their location. A VPN is therefore not a geographic defence against the law's requirements. Second, platforms are prohibited from facilitating or encouraging VPN circumvention — including publishing instructions explaining how to use a VPN to access the site from Utah.

The exact statutory language of the prohibition reads: "A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements, including by providing: (a) instructions on how to use a virtual private network or proxy server to access the website; or (b) means for individuals in this state to circumvent geofencing or blocking."

Enforcement of the VPN provisions is stayed until 3 September 2026 while Aylo (the parent company of Pornhub) challenges the law's constitutionality in federal court. The primary First Amendment concern is the instructions-prohibition prong: holding a platform liable for publishing editorial content — including informational how-to material about VPNs — raises significant free speech questions that the courts have not yet resolved.

Bills that would have explicitly banned VPN access (now dead)

Two bills proposed far more aggressive VPN restrictions than anything that has been enacted. Neither became law.

Their deaths do not mean the legislative direction has reversed. The EFF noted in November 2025 that these drafting patterns — explicit VPN-blocking mandates, ISP infrastructure requirements — are spreading across state legislatures, and that many sponsors appear not to understand how VPNs actually work at a technical level.

• Wisconsin AB 105 / SB 130 (2025–2026): Required websites to block all users connected via a VPN. The VPN provision was stripped by Senate amendment in February 2026; Governor Evers vetoed the amended bill in April 2026 on privacy and biometric grounds — the first US governor to veto age-verification legislation of this type.
• Michigan HB 4938 — 'Anticorruption of Public Morals Act' (2025): Required ISPs to 'actively monitor and block known circumvention tools,' defined to include 'virtual private networks, proxy servers, and encrypted tunneling methods.' Penalties of $500,000 per violation. The bill stalled in House Judiciary Committee with no hearings.

Federal legislation: the SCREEN Act

The SCREEN Act (S. 737 / H.R. 1623, introduced February 2025) would require platforms to subject "Internet Protocol (IP) addresses, including known virtual proxy network (VPN) IP addresses" to age verification. Unlike the dead state bills, it would not ban VPN use — it would require platforms to verify the age of VPN-connected users rather than allow them to bypass verification. The bill is in Senate Commerce Committee with no hearings scheduled.

The bill uses the phrase "virtual proxy network" rather than the standard "virtual private network." This is confirmed in the Congressional Research Service summary of the bill — it is a drafting quirk, not an intentional carve-out or a reference to a different technology.

The four mechanisms legislators use

Four distinct legal mechanisms have appeared across this legislation, with different burdens and different targets. Understanding which mechanism a bill uses determines what it would actually require and who it would bind.

• Deemed-location clause — The platform bears liability for Utah users regardless of VPN masking. A VPN is not a geographic defence; the user's legal location is fixed by state law, not by their IP address. (Utah SB 73)
• Instructions prohibition — Platforms cannot publish VPN how-to content that helps users access the site from a restricted state. The platform is liable for editorial content, not just technical circumvention. (Utah SB 73)
• Website VPN-blocking mandate — Platforms required to actively block all VPN-connected users from accessing the site. A blanket technical block on all VPN IP addresses. (Wisconsin AB 105, now dead)
• ISP infrastructure mandate — Carriers required to detect and block all VPN traffic at network level. Effectively a Great Firewall architecture applied to a domestic ISP. (Michigan HB 4938, now dead)

What this means for VPN users and providers

For users: a VPN does not make you legally invisible. If you are in a state with an age-verification law and you use a VPN to bypass the check, you may still be subject to that state's law. What a VPN changes is the platform's ability to detect where you are — not your legal status under state law. In Utah specifically, the deemed-location clause removes any ambiguity: the platform is liable for you as a Utah user regardless of your apparent IP address.

For VPN providers: the only enacted law (Utah) targets platforms, not VPN services themselves — a platform cannot publish instructions about VPNs, but a VPN provider is not directly restricted. The Michigan ISP-mandate bill was the one that would have targeted carriers and indirectly squeezed VPN traffic; it is dead. The KOSA federal bill had provisions that swept VPN providers into "covered platform" definitions, but a Senate committee amendment partially mitigated that. The EFF has flagged the overall pattern as likely to continue, with future bills becoming more technically sophisticated as legislative drafters learn from early failures.

出典・参考資料

• EFF — Lawmakers Want to Ban VPNs—And They Have No Idea What They're Doing (Nov 2025)
• EFF — VPNs Are Not a Solution to Age Verification Laws (Jan 2025)
• EFF — Wisconsin: VPN Bans Are Still a Terrible Idea (Feb 2026)
• EFF — Utah's New Law Regulating VPNs (Apr 2026)
• Techdirt — Utah Wants Websites To See Through VPNs. That's Not How VPNs Work. (May 2026)
• Cato Institute — Policymakers Should Stop Going After VPNs (Jan 2026)
• Michigan HB 4938 — Michigan Legislature