Utah to hold websites liable for users who mask their location with VPNs

Utah becomes the first U.S. state to hold websites liable for users who mask their location with VPNs under Senate Bill 73, effective May 6. The law requires websites to identify users' true physical locations despite VPN masking — a requirement security experts say is technically impossible. Industry critics including NordVPN and the EFF warn it creates compliance paradoxes and may force sites to globally mandate age verification or ban all known VPN IPs.