Thread

Court agrees with EFF: Utah's VPN law demands a technical impossibility

802 points · 405 comments · hn_acker

mahboi · 1790964379 · focus · HN ↗
How is this impossible? DraftKings does it for California visitors.
1. abirch · 1790964434 · focus · HN ↗
  they want to stop VPN traffic. If it's a plain IP address it's easy. VPN makes it hard.
  1. mahboi · 1790964656 · focus · HN ↗
    I understand. You can't use DraftKings via a VPN.
    abirch · 1790965582 · focus · HN ↗
    What stops me from using DraftKings.com from a VPN? I'm at the page right now, but I don't have an account. Will they verify that my IP and home address match or something?
    mahboi · 1790966026 · focus · HN ↗
    They have an extensive blacklist of VPNs, and on top of that will require you to verify location on a phone if you don't have an obvious residential IP. Or maybe they just always do that? Of course if you have a sketchy proxy and a phone where you can spoof location and you can ensure they don't flag it as something "unverified" like GrapheneOS, you can get around it, and you'd be in a small minority.
    Unfortunately know this because a gambler friend showed me.
    hn_acc1 · 1790966583 · focus · HN ↗
    I've found that some sites (even like restaurants, for example) have no problem setting up an order when I connect via my VPN (from Linux) - my default browsing setup. But when I go to pay, their payment processor refuses to work properly / fails, so I can't actually transact any $$. Others work just fine WITH VPN on. Sadly, the former is increasing and the latter decreasing, to the point it's getting harder and harder.
    Heck, Lowes and BestBuy are pretty unusable in general via VPN already.. (or maybe due to ublock, or privacy badger or eff, etc.. :-)
2. compiler-guy · 1790964862 · focus · HN ↗
  DraftKings does it in a way that is good enough to comply with California law, which doesn't require perfection.
  This Utah law requires perfection.
  1. mahboi · 1790965807 · focus · HN ↗
    Oh I see, "An individual is considered to be accessing the website from this state if the individual is actually located in the state regardless of whether the individual is using..." as mentioned in the injunction <a href="https://www.courthousenews.com/wp-content/uploads/2026/09/aylo-freesites-utah-division-consumer-protection-opinion.pdf" rel="nofollow">https://www.courthousenews.com/wp-content/uploads/2026/09/ay... So yeah the law would basically require everywhere to perform age verification, where the law says it only has to be "commercially reasonable."
    rvba · 1791059880 · focus · HN ↗
    that is the plan, to make everyone have to use utah law
    underlying reason is hatred for free internet
3. Ukv · 1790965364 · focus · HN ↗
  I'm not in California and DraftKings blocks me connecting with a VPN, so they just don't seem to be distinguishing whether a VPN user is in California (which is the impossible part of this law).
  1. mahboi · 1790965882 · focus · HN ↗
    Right, they just block all VPN users, which would comply with the law
    iAMkenough · 1790967642 · focus · HN ↗
    I have no problem connecting via a VPN running on my VPS, so it's not all VPN users.
    A VPN/proxy could exist on any given IP address at any time, which the California law recognizes but the Utah law does not.
    Ukv · 1790973447 · focus · HN ↗
    Utah argues that websites can "age assure VPN-using Utahns, [so] any decision by Aylo to instead age-verify all users would be a voluntary business choice, not an effect forced by Utah law" because regulating non-Utah users on non-Utah sites is not something the Utah law can constitutionally do under the Dormant Commerce Clause.
    So in theory sites could block all VPN users (if you can somehow "perfectly (1) detect VPN/proxy users"), but if the law necessitates that nationally/globally then it's unconstitutional anyway. It's the age assuring of VPN-users specifically from Utah part that Utah are relying on being possible for the law the be constitutional.
    randyrand · 1791004901 · focus · HN ↗
    Easier said than done.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.