Utah’s VPN Restrictions & Hidden ALPR Data: How New State Laws Threaten Digital Privacy

Featured image: Photo by Patrick on Pexels.

Across the United States, digital privacy is facing unprecedented challenges as state legislatures introduce and enact laws that fundamentally alter how individuals can protect their online activities and how the public can oversee government surveillance. Two distinct yet interconnected trends highlight this erosion: Utah’s pioneering restrictions on Virtual Private Networks (VPNs) and a growing movement among states to shroud Automated License Plate Reader (ALPR) data in secrecy. These legislative actions, though targeting different aspects of digital life, collectively threaten the fundamental architecture of a private and secure internet, making it harder for citizens to maintain anonymity and hold their governments accountable.

Utah’s Unprecedented Move Against VPNs

Utah is poised to set a concerning precedent with its new law, Senate Bill 73 (SB 73), formally known as the “Online Age Verification Amendments.” While much of the bill focuses on a 2% tax on online adult content, a critical section directly targets VPN use, going into effect on May 6, 2026 [1]. This makes Utah, to the knowledge of digital rights advocates, the first state in the nation to specifically regulate VPNs in an effort to enforce age-verification gates online [1].

The core of SB 73’s VPN provisions lies in two main areas. Firstly, it stipulates that an individual is considered to be accessing a website from Utah if they are physically located within the state, irrespective of whether they employ a VPN, proxy server, or any other method to mask their geographical location. Secondly, the law prohibits commercial entities that host “a substantial portion of material harmful to minors” from facilitating or encouraging the use of a VPN to bypass age checks. This includes providing instructions or means to circumvent geofencing [1].

These provisions create a significant “liability trap” for websites. If a site cannot reliably detect a VPN user’s true location and the law demands age verification for all users in Utah, the legal risk could force websites to either block all known VPN IP addresses or mandate age verification for every visitor globally. Such an outcome would subject millions of users to invasive identity checks or block their legitimate VPN use, regardless of their actual domicile [1].

Unlike more extreme proposals seen in other states, SB 73 does not explicitly ban VPN usage. Instead, it operates under a “don’t ask, don’t tell” style of enforcement, primarily by imposing liability on websites and restricting them from sharing information about VPNs. This approach, however, raises significant First Amendment concerns, as it curtails platforms’ ability to provide truthful information about a lawful privacy tool to their users [1]. The law’s technical feasibility is also questionable; blocking all known VPN and proxy IP addresses is an ongoing, unwinnable technical challenge, as providers constantly add new IP addresses. The internet is inherently designed to route around censorship, and sophisticated users will undoubtedly find non-commercial proxies or private tunnels, rendering the law ineffective against its intended targets while harming legitimate users [1].

The real collateral damage will fall upon businesses, journalists, and survivors of abuse who rely on commercial VPNs for essential data security and privacy. These provisions are unlikely to deter a tech-savvy teenager but will significantly impact the privacy of every regular Utah resident simply trying to keep their data safe from brokers or malicious actors [1]. Utah’s move is an attack on the very tools that enable digital privacy, setting a dangerous precedent that prioritizes government control over the fundamental architecture of a private and secure internet. This trend could inspire similar restrictions in other states and even countries, as regulators increasingly view VPNs as “loopholes” rather than essential security and privacy tools [1].

ALPRs and the Erosion of Public Oversight

Concurrent with Utah’s VPN restrictions, a concerning trend is emerging regarding Automated License Plate Readers (ALPRs). ALPRs are surveillance technologies used by law enforcement to automatically capture license plate information, along with the date, time, and location, creating vast databases of people’s movements. For years, journalists, community advocates, and organizations like the EFF have utilized public records laws—often known as Freedom of Information Acts (FOIAs) or Public Records Acts (PRAs)—to shed light on how law enforcement agencies use and share ALPR data [2]. This public scrutiny has been crucial in revealing misuse, abuse, and often misleading narratives surrounding these powerful surveillance tools [2].

However, lawmakers in several states are now actively introducing or enacting measures to exempt broad categories of ALPR information from public disclosure. This includes critical details such as the extent of law enforcement use, specifics on data sharing across agencies, the number of license plate scans conducted, their locations, the “hit” rates for plates of interest, analyses of false matches or errors, and even images of individuals’ own vehicles [2]. These legislative efforts are often a direct response to public revelations of ALPR abuses, indicating a move to block the very oversight capabilities that public records laws provide [2].

The rationale behind these proposed exemptions often cites privacy concerns, suggesting that wholesale public disclosure of raw ALPR data could exacerbate privacy harms. While legitimate concerns exist about indiscriminately releasing personally identifiable ALPR data, many current proposals do not offer a measured approach to balancing privacy with the public’s right to know [2]. ALPR data is inherently revealing, detailing where a person goes, what they do, and who they associate with. It is dangerous that police possess so much of this information, and it would be even worse for it to be disclosed to third parties like employers or political opponents [2].

Despite these privacy risks, public access to certain ALPR information has proven invaluable for accountability. Investigations using ALPR data-sharing reports and hit ratios have exposed the vast extent of data sharing between police departments, identified racist uses of ALPR systems, documented surveillance of protestors, and even tracked individuals seeking abortions [2]. Communities have leveraged these disclosures to block new ALPR deployments, refuse contract renewals, and terminate agreements with surveillance vendors whose practices were deemed too dangerous. Without this evidentiary record, it becomes significantly harder for cities to exercise their power to say no to intrusive technologies [2].

The trend of blocking transparency is alarming and widespread. States like Connecticut and Arizona have pending bills (SB 4 and SB 1111, respectively) that would exclude ALPR data and information derived from it from public records laws, with Arizona’s bill even making it a felony to access or disseminate such data in violation of the article [2]. Washington state recently enacted a similar law, overriding previous court decisions that found ALPR-generated information, including images of an individual’s vehicle, to be public records [2]. Illinois, Georgia, Maryland, and Oklahoma have also moved to exempt various forms of ALPR data from their open records acts, effectively creating a national trend that stifles public oversight of powerful surveillance technology [2].

A Balanced Approach to ALPR Data Transparency

There is a better path to harmonizing privacy and transparency regarding ALPR data than outright bans on disclosure. Legislators should reject efforts to wholly exempt ALPR information from public records laws, as this diminishes meaningful oversight [2]. Instead, open records laws should explicitly cover ALPR information and any records derived from it. To protect individual privacy, these laws should incorporate a robust privacy exemption that requires a case-by-case balancing of the transparency benefits against the privacy costs of disclosure [2].

This balancing approach allows for nuance. When a document contains both exempt and non-exempt information, laws should mandate the disclosure of the latter while withholding the former, often through redaction [2]. Agencies and courts can black out specific private information while disclosing non-private parts of the same records, effectively threading the needle between privacy and transparency. Furthermore, in the context of ALPR databases, the law should permit agencies to disclose aggregated and/or de-identified data while withholding personally identifiable information [2]. This allows the public to understand the scope and impact of ALPR use—such as the amount of data collected and error rates—without compromising individual privacy. Such aggregated data is crucial for informed public discussion and oversight of how policing agencies operate [2].

Conclusion

The legislative landscape in states like Utah and others across the nation reveals a troubling trajectory for digital privacy. Whether it’s through direct attacks on privacy-enhancing tools like VPNs or by cloaking government surveillance programs in secrecy, these new laws represent a significant shift towards greater state control over digital life. As technology continues to evolve, it is imperative that lawmakers prioritize the fundamental rights to privacy and transparency, ensuring that citizens can protect their digital footprint and hold their governments accountable for the use of powerful surveillance technologies. The current trend, if unchecked, promises an increasingly less private and less transparent digital future.

Key Takeaways

• Utah’s SB 73 is the first state law to target VPN use for bypassing age verification, creating a “liability trap” for websites and threatening legitimate VPN users [1].
• The law’s technical feasibility is questionable, and it sets a dangerous precedent for government control over digital privacy tools [1].
• States are increasingly enacting laws to exempt ALPR data from public records, hindering public oversight of surveillance technologies [2].
• Public access to ALPR data has historically been crucial for exposing misuse and holding law enforcement accountable [2].
• A balanced approach is needed for ALPR data, allowing disclosure of aggregated information and case-by-case balancing of privacy and transparency through redaction [2].

Sources

1. [1] Utah’s New Law Targeting VPNs Goes Into Effect Next Week (www.eff.org)
2. [2] Open Records Laws Reveal ALPRs’ Sprawling Surveillance. Now States Want to Block What the Public Sees. (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.