Utah to hold websites liable for users who mask their location with VPNs

Utah's new law holds websites liable for age verification bypasses via VPNs, creating significant compliance burdens for IT organizations despite being technically unenforceable and potentially unconstitutional. The law will likely force companies to choose between banning all VPN traffic globally, implementing invasive surveillance technologies, or accepting legal liability—while doing little to stop determined users and harming legitimate privacy needs. IT leaders must prepare for similar legislation spreading across other states and internationally, requiring urgent legal review and potentially substantial infrastructure changes to detection and verification systems.