A landmark victory for digital rights and technical reality

Court Agrees with EFF: Utah's VPN Law Demands a Technical Impossibility

Electronic Frontier Foundation

October 2026

02

Utah's Controversial VPN Legislation

Understanding the mandate that defied technical possibility

What the Law Demanded

01

Age Verification Requirements VPNs required to verify users' age before providing service
02

Identity Documentation Mandatory collection of government-issued ID from users
03

Parental Consent Protocols Minors required explicit parental approval for VPN access
04

Data Retention Obligations Service providers must maintain detailed user records

04

The Technical Impossibility

Why compliance was fundamentally unachievable

The Core Conflict

1

VPN Purpose

VPNs route traffic through encrypted tunnels to protect user identity

→

2

Anonymity by Design

The technology intentionally prevents user tracking and identification

→

3

Impossible Requirement

Law demands verifying the very users that VPNs are built to hide

→

4

Fundamental Contradiction

Compliance would require dismantling core VPN functionality

The court recognized that the law demands VPN providers do the impossible: identify anonymous users while preserving the anonymity that defines their service.

EFF Legal Analysis

Why This Victory Matters

gavel

Legal Precedent

Courts acknowledge technical limitations when crafting tech policy

security

Privacy Protected

VPN users retain their fundamental right to anonymous browsing

lightbulb

Innovation Safe

Developers can build tools without impossible legal constraints

verified_user

Digital Rights

Reinforces that laws must align with technological reality

Thank You

Technology policy must respect technical reality

www.eff.org