Utah has become the first U.S. state to hold websites liable for users who mask their location with VPNs. The law requires sites to verify age or face penalties for serving restricted content to minors.
Utah's new legislation creates legal responsibility for websites when users employ VPNs to circumvent age-based content restrictions. Under the law, sites offering age-restricted material—including adult content, gambling, and alcohol sales—must implement verification systems that account for VPN usage.
The statute marks a significant shift in online regulation. Previously, responsibility for accessing age-restricted content fell primarily on users. This law transfers accountability to website operators, requiring them to implement detection methods capable of identifying VPN connections and preventing access to such content.
Websites that fail to comply face liability claims. The law does not specify exact penalties, but creates a legal framework allowing enforcement action against platforms that serve age-restricted content to minors, whether through direct access or VPN masking.
The move raises technical and practical concerns. VPN detection remains imperfect, with many services specifically designed to avoid detection. Compliance could require websites to deny service to all VPN users or implement expensive age-verification systems. Some services may simply block Utah users rather than comply.
Privacy advocates have raised concerns about age-verification requirements, which often demand personal identification data. Such systems create security and privacy risks while potentially excluding legitimate users from legal services.
Other states have considered similar legislation. The regulatory trend reflects growing pressure to restrict minors' online access to adult content and services, though implementation challenges remain significant.
The law's enforceability and constitutional standing have yet to be tested in court. Legal experts question whether holding websites responsible for user behavior enabled by third-party software (VPNs) falls within reasonable regulatory scope.
Hacking group FulcrumSec claims to have stolen 86 GB of data from Manchester Airports Group. Security researchers confirmed the breach included detailed customer, booking, and travel records.
Multiple extensions in the Chrome Web Store and Microsoft Edge delivered malware that stole cryptocurrency, browser data, and user history while injecting fraudulent ClickFix lures.
A new survey reveals strong public opposition in the UK to government surveillance of encrypted communications. The findings highlight growing concern over privacy rights as lawmakers continue debating message scanning proposals.
PaperCut has released a second emergency security update for its NG and MF print management software after researchers discovered bypass methods for the initial fixes. The vulnerabilities are currently being exploited in the wild.