Digital Privacy Under Attack: Utah’s VPN Law, ALPR Surveillance, and Global Policy Challenges

Featured image: Photo by Miguel Á. Padriñán on Pexels.

The landscape of digital privacy is undergoing rapid and significant changes, challenging fundamental rights and reshaping the way individuals interact with the online world. From state-level legislative efforts targeting privacy tools to the pervasive spread of surveillance technologies and complex international policy debates, the battle for a private digital future is intensifying. These developments underscore a growing tension between governmental control and individual anonymity, demanding critical examination and robust advocacy to protect user rights.

Utah’s Unprecedented Attack on Digital Privacy

In a move that sets a concerning precedent, Utah is poised to become the first state in the nation to directly target the use of Virtual Private Networks (VPNs) to circumvent age-verification mandates. Effective May 6, 2026, Senate Bill 73 (SB 73), formally known as the “Online Age Verification Amendments,” introduces provisions that declare an individual to be accessing a website from Utah if they are physically present in the state, regardless of any technical measures used to disguise their location, such as VPNs or proxy servers [1].

The law also prohibits commercial entities that host “a substantial portion of material harmful to minors” from facilitating or encouraging VPN use to bypass age checks. This includes providing instructions or means to circumvent geofencing. This creates a significant “liability trap” for websites; if they cannot reliably detect a VPN user’s true location while being legally obligated to do so for Utah residents, they might resort to banning all known VPN IP addresses or mandating age verification for every visitor globally. Such measures would subject millions of users to invasive identity checks or block their legitimate use of VPNs, irrespective of their actual geographic location [1].

Beyond the technical challenges, SB 73 raises serious First Amendment concerns. By muzzling websites from sharing basic, truthful information about a lawful privacy tool, the law restricts free speech. While it stops short of an explicit VPN ban, adopting a “don’t ask, don’t tell” enforcement style, it remains a dangerous precedent. The technical reality is that blocking all known VPN and proxy IP addresses is an unwinnable “whack-a-mole” game; new addresses are constantly added, and no comprehensive blocklist exists. Motivated users will inevitably find workarounds using non-commercial proxies or private tunnels, rendering the law ineffective against its intended targets [1].

The collateral damage, however, will be substantial. Businesses, journalists, and survivors of abuse who rely on commercial VPNs for essential data security and privacy will be adversely impacted. This law, rather than creating a safer internet, will primarily undermine the privacy of regular Utah residents seeking to protect their data from brokers or malicious actors. This legislative direction is not isolated; regulators in countries like the United Kingdom and France have also expressed interest in restricting VPNs, signaling a global trend towards government control over fundamental digital privacy tools [1].

The Expanding Reach of ALPR Surveillance and Retreat from Transparency

Another critical front in the digital privacy battle involves Automated License Plate Readers (ALPRs). These surveillance systems are rapidly expanding their reach, collecting vast amounts of data on vehicle movements across the country. Historically, public records laws, such as Freedom of Information Acts (FOIAs) or Public Records Acts (PRAs), have been instrumental for reporters, community advocates, and organizations like EFF to expose and challenge the misuse and abuse of ALPR data by law enforcement agencies [2].

However, a disturbing trend is emerging: several states are enacting or proposing laws to block public access to ALPR data. These measures aim to exclude broad categories of information from public disclosure, including details on law enforcement use, data sharing across agencies, the number of scans conducted, “hit” rates for vehicles of interest, error analyses, and even images of individuals’ own vehicles [2]. This deliberate obfuscation prevents meaningful oversight of a technology that is deeply revealing about a person’s movements, associations, and activities. The EFF, for instance, opposes ALPRs precisely because of the privacy violations inherent in the government’s extensive collection and retention of this information [2].

While legitimate privacy concerns exist regarding the wholesale public disclosure of raw ALPR data, the current legislative proposals often fail to strike a measured balance between privacy and transparency. Instead of outright bans on disclosure, a better path involves applying existing privacy exemptions within public records laws, requiring a case-by-case balancing of transparency benefits against privacy costs. This can involve redacting truly private information while disclosing non-private elements, or releasing aggregated and deidentified data to inform public discourse without compromising individual privacy [2].

The value of public access to ALPR information is undeniable. Through public records, advocates have exposed racist uses of ALPR systems, surveillance of protestors, and tracking of individuals seeking abortions. Such disclosures have empowered communities to block new deployments, refuse contract renewals, and terminate agreements with surveillance vendors whose practices proved too dangerous. Without this critical evidentiary record, accountability for ALPR programs becomes significantly harder. Yet, states like Connecticut, Arizona, Washington, Illinois, Georgia, Maryland, and Oklahoma are moving to restrict or entirely exempt ALPR data from public records laws, effectively stymieing the public’s ability to monitor these powerful and controversial technologies [2].

Global Efforts for Digital Fairness and the Peril of Surveillance-Based Solutions

On a broader global scale, policymakers are grappling with how to ensure “digital fairness” in an increasingly complex online environment. The European Union, for example, is entering an enforcement era for major digital laws and is now considering a proposed Digital Fairness Act (DFA) to address issues like dark patterns and exploitative personalization. While the intent is to update consumer rules for the digital age, some proposed solutions risk undermining fundamental rights by relying on expanded surveillance, such as age verification mandates [3].

These “surface-level fixes” often offer a false sense of protection while pushing platforms to exert more control over users. For effective digital fairness, the focus should be on addressing the root causes of harm, safeguarding privacy, freedom of expression, and user rights. This means prioritizing privacy by tackling harms driven by surveillance-based business models and deceptive design practices. It also involves strengthening user sovereignty, which entails addressing user lock-in, coercive contract terms, and manipulative defaults that limit users’ ability to freely choose how they use digital products and services [3].

Key recommendations for achieving digital fairness include a clear prohibition of misleading interfaces, commonly known as dark patterns, that distort user choice in commercial contexts. Furthermore, the DFA should directly confront commercial surveillance by reducing reliance on data exploitation. This involves strengthening privacy rights, banning “pay-for-privacy” schemes where users must trade data or pay extra to avoid tracking, and supporting automated privacy signals from web browsers and operating systems. Crucially, for children’s online safety, limiting data use by default is a more rights-respecting approach than invasive age verification [3].

Strengthening user sovereignty also means addressing unfair post-sale restrictions that turn product ownership into conditional rentals. Digital products and services often come with opaque licensing terms, technical protection measures, and remote controls that limit lawful use, modification, or access after purchase. The DFA should set clear limits on these unfair terms, promote robust transparency, and foster interoperability, empowering users to control and switch services, access third-party applications, and reduce lock-in [3].

The Interconnected Battle for a Private Digital Future

The challenges to digital privacy are multifaceted and interconnected. From Utah’s legislative attempts to control VPN usage, which could set a dangerous precedent, to the widespread deployment of ALPRs and the simultaneous efforts to shield their data from public scrutiny, and finally, to global policy discussions like the EU’s Digital Fairness Act, the underlying theme is a struggle for control over personal data and digital autonomy. These developments highlight a critical juncture where policymakers must choose between fostering a surveillance-heavy digital environment or upholding the fundamental rights to privacy and freedom of expression. Protecting privacy tools like VPNs, ensuring transparency in surveillance programs, and crafting digital fairness policies that prioritize user sovereignty over data exploitation are essential steps in securing a more private and equitable digital future for everyone.

Key Takeaways

• Utah’s new law targeting VPNs to bypass age verification sets a concerning precedent for digital privacy and may lead to widespread VPN restrictions or global age verification [1].
• Automated License Plate Readers (ALPRs) enable extensive surveillance, and state efforts to block public access to ALPR data undermine crucial oversight and accountability [2].
• Achieving digital fairness requires prioritizing privacy by tackling surveillance-based business models and deceptive design, rather than relying on expanded surveillance measures like invasive age verification [3].
• Strengthening user sovereignty by banning dark patterns, reducing data exploitation, and promoting interoperability is vital for empowering individuals in the digital realm [3].
• The ongoing legislative and policy challenges underscore a global struggle to balance governmental and corporate interests with fundamental individual rights to privacy and anonymity.

Sources

1. [1] Utah’s New Law Targeting VPNs Goes Into Effect Next Week (www.eff.org)
2. [2] Open Records Laws Reveal ALPRs’ Sprawling Surveillance. Now States Want to Block What the Public Sees. (www.eff.org)
3. [3] Getting Digital Fairness Right: EFF's Recommendations for the EU's Digital Fairness Act (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.