Why a VPN Can't Block Utah (or Anywhere Else)

A court sided with the EFF this week: Utah's VPN law demands a technical impossibility. Strip away the legal citations and the ruling is about one question — what can a network endpoint actually know about a person? If you've ever shipped a geo-block or an age gate, that question is yours too.

Here's the uncomfortable part: your geo-block makes the same assumption the law did. That an IP address tells you who someone is and where they are.

Why this matters

Regulators keep writing compliance rules as if IPs were identities. They're router coordinates: shared by thousands of carrier-NAT users, rented by the hour from proxy networks, reassigned across continents. A court admitting the mismatch is useful ammunition the next time someone asks why "block region X" isn't a checkbox.

You'll still build region rules — licensing, GDPR, sanctions. The skill is knowing exactly how solid that floor is.

How it works

A VPN server is a packet router with a terrible view. The complete inventory of what it observes per session:

• The client IP at handshake — itself often shared NAT, or someone else's proxy.
• Byte counts, timestamps, connection duration.
• Destinations, only if DNS or SNI leaks in plaintext — ECH and DoH are closing that gap.

It never sees content; TLS guarantees that. And it can't derive the two things the law wanted: age and physical location. Turning any IP into "this user is in Utah" means querying a commercial geolocation database — a statistical guess that mobile carriers break daily, since a phone in Salt Lake City can egress from a gateway in Denver.

Where this helps

• Streaming and licensing: per-country enforcement becomes IP-reputation whack-a-mole against exit nodes that rotate weekly.
• GDPR blocking: EU users on a US trip look local and skip the consent wall; US users behind a VPN get the cookie banner for nothing.
• Sanctions screening: serious programs treat IP as one signal among account, payment, and KYC checks — never the whole decision.

Watch out

Don't overcorrect into "geo-blocking is theater." Coarse IP filtering is still right for defaults, CDN routing, and raising the cost of casual circumvention. Two real failure modes: trusting state-level precision (country accuracy runs high-90s percent; region accuracy is far worse), and treating datacenter-IP blocklists as VPN detection — huge chunks of legitimate B2B traffic come from AWS NAT gateways.

And document the gap. When legal asks whether the block is effective, "probabilistically" is the honest answer.

Try it yourself

One lookup shows you the entire evidence base behind geolocation:

# Everything the internet knows about "where you are":
curl -s ipinfo.io/json | jq '{ip, city, region, country, org}'

# Now connect any VPN and run it again.
# Watch "region" flip to the exit node. That's the whole trick.

TL;DR

• What changed: a court agreed with the EFF that Utah's VPN law demands what the technology cannot deliver.
• Why it matters: IPs are endpoints, not identities — every geo-block and age gate you ship rests on the same probabilistic guess.
• Try today: run the ipinfo lookup with and without a VPN, then check what your own geo-stack would conclude from each answer.