• Utah's SB 73 law targeting VPN users has officially gone into effect
• Fight for the Future has slammed the legislation as a "waste of money"
• The digital rights group also argues it's "impossible by design" to enforce

Utah is making history as the first US state to enact a law specifically targeting virtual private networks, but digital rights advocates are furious.

The legislation, known as SB 73, officially went into effect on May 6. It aims to crack down on residents utilizing the VPN services to bypass state age verification mandates.

However, digital rights group Fight for the Future is pulling no punches. In a fiery statement shared with TechRadar, the group dubbed the law "a waste of money," while slamming the state for passing legislation that fundamentally misunderstands how the internet works.

"Utah just became the first state in the US to target VPN usage, and they are embarrassing themselves," stated Lia Holland, Campaigns and Communications Director at Fight for the Future.

Last year, Fight for the Future launched a major initiative to defend VPN access, highlighting that everyone from abuse survivors to small businesses relies on these tools to stay secure.

What is the Utah VPN law and why are experts so angry?

The bill's most controversial element is Section 14, which explicitly states that individuals are considered to be accessing a website from Utah if they are physically there, "regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location to make it appear that the individual is accessing a website from a location outside this state."

According to Holland, these requirements have "paragraphs that read like AI slop" because they mandate the impossible.

A reputable Virtual Private Network (VPN) protects your privacy by completely encrypting your traffic and hiding your real IP address. Consequently, the website you visit physically cannot determine whether you are browsing from Utah or anywhere else.

"This feat is literally impossible by design for even the best hacker," Holland noted, questioning whether lawmakers actually understand what the security software does.

Because websites cannot pinpoint a VPN user's true location, Fight for the Future warns that businesses are left with limited options. They must either try to block all global VPN traffic, implement mandatory age verification for every visitor worldwide, or censor all content that falls under Utah's "harmful to minors" umbrella.

Or, as Holland suggests, there is a fourth option: "sue Utah."

In fact, Fight for the Future said to "pre-emptively endorse" any legal actions filed to hold Utah politicians accountable. The guilt? "Continuing to ignore, in the year 2026, the basics of how the Internet they're trying to regulate functions," the group notes.

A growing battle over digital rights

This is not the first time digital rights advocates and VPN providers have sounded the alarm over these types of age verification mandates.

Previously, cybersecurity experts at the Electronic Frontier Foundation described the Utah bill as an unworkable "technical whack-a-mole," while major provider NordVPN slammed the legislation as a dangerous "liability trap."

Similar efforts to restrict VPNs in other states have faltered. Recently, Wisconsin lawmakers scrapped a proposed VPN ban from an age verification bill after significant pushback, a move advocates called a rejection of a "spectacularly bad idea."

For Fight for the Future, the message to state lawmakers is clear.

"Instead of doubling down with more embarrassing laws that are bound to fail, Utah should strike an actual blow at Big Tech and put rights that keep people safe, like privacy, at the center of their legislative agenda," Holland said.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

Rene Millman is a seasoned technology journalist whose work has appeared in The Guardian, the Financial Times, Computer Weekly, and IT Pro. With over two decades of experience as a reporter and editor, he specializes in making complex topics like cybersecurity, VPNs, and enterprise software accessible and engaging.