Utah and Congress propose VPN rules: what your VPN hides and what to ask your provider

If you use a VPN (a service that routes your traffic through an encrypted tunnel via an intermediary server), you have probably come across a website that asked you to “turn off your VPN” or simply would not load. In recent weeks, two regulatory proposals concerning VPNs have been published in the United States. The first concerns websites; the second concerns VPN providers themselves. Both help explain what a VPN actually does and what else is worth checking.

What was published

Utah: websites would have to identify people hiding their location. The Utah Department of Commerce’s Division of Consumer Protection published proposed rules (R152-78B) to implement SB 73. The rules address the responsibilities of websites that publish content defined as harmful to minors and include an age verification requirement. According to the official comments submitted by the digital rights organization EFF, the proposal requires these websites to use a “commercially reasonable location concealment detection system.” In practice, they would have to try to identify visitors from Utah even when they connect through a VPN. According to EFF, the signals listed in the proposal include connection latency (the time it takes for data to travel back and forth), the time zone set on the device or in the browser, and “other relevant data” sent by the device.

EFF argues that the requirement is technically impossible to meet. It says a website has no reliable way to tell whether a VPN connection originates in Salt Lake City, Seattle, or Shanghai. Websites could therefore be left with only two options: stop operating in Utah or block all VPN users, everywhere. The organization also warns that the proposed signals are unreliable. Latency, for example, is affected by weak cellular reception or network congestion. It further warns that websites would have to collect information about every visitor’s device, and that information collected to verify age and location could be kept for a long time. According to EFF, the Utah privacy law referenced in the rules allows businesses 90 days to process a deletion request.

Congress: blocking through the VPN provider. According to an EFF post, Congressman Darrell Issa introduced the American Copyright Protection Act (ACPA, H.R. 10364). Under the proposal, a copyright holder could ask a court to designate a foreign website as a “foreign piracy site.” The holder could then seek orders requiring internet service providers, DNS providers (the service that translates a website name into its numerical address), and explicitly VPN providers to take “commercially reasonable measures” to prevent users in the United States from accessing the site. EFF notes that a similar proposal from last year exempted providers that offer only VPN services. The new proposal removes that exemption. EFF says it also broadens the definition of a piracy site. A designation could be issued without the accused website appearing to defend itself. EFF acknowledges that the proposal includes some safeguards, including notice to providers, a financial bond, and the option to ask for the designation to be revoked. In its view, however, these safeguards do not resolve the underlying problem.

Media coverage gave a specific date for the bill’s introduction. The EFF post does not give that date, so we will not include it here.

What this means for you

Your address is protected, but the other details matter too. An IP address is the number that identifies your connection on the network. It usually reveals your country, region, and internet service provider. A VPN replaces it with the address of the server you connect to. Websites therefore see the server’s address instead of yours. Alongside that address, your browser and device send websites other details, such as language settings and browser type. The combination of these details is sometimes called a “digital fingerprint.” According to EFF, the Utah proposal lists signals of this kind, including the time zone and connection latency. Many of these settings are under your control, so it is worth getting to know them and checking them from time to time.

These signals can be misleading. This can happen, for example, when you browse on a train with weak reception, travel on vacation without updating your clock, or connect through a congested network. EFF believes that websites unable to distinguish a visitor from Utah from one in Tel Aviv may take the easy option and block all VPN users. In other words, a rule in one US state could affect you too. Requests to “turn off your VPN” and mistaken blocks are likely to become more common. In these situations, people turn off their protection while connected to a hotel or airport network just to keep browsing. It is best to avoid doing that.

Detection requires data collection. To identify VPN users, a website needs to examine more information about every visitor, not just VPN users. EFF warns that this information, alongside age verification data, could accumulate and become a target for breaches and leaks. Before giving a website an identity document or personal details, ask how long they will be kept and what will happen to them afterward.

The provider itself may filter websites. The federal proposal works differently. Rather than trying to identify you, it seeks to require the provider you connect through to block websites under a court order. According to data cited by EFF, similar blocking systems in Europe have also affected legitimate websites. In Italy, 510 websites unrelated to the broadcasts were blocked, including a monastery’s website and a telemedicine platform. In Spain, more than 550 thousand domains were blocked during football broadcasts. So, alongside “Does the VPN hide me?”, it is worth asking what the provider filters, under what authority, and whether it tells you about it.

What the two proposals have in common. Both treat a VPN as an obstacle to work around or a service that can be required to take part in blocking, rather than as a basic security tool. There is no need for alarm: these are proposed rules and a bill, not existing obligations. Still, it is worth understanding the implications now, before they begin to affect everyday use. For small-business owners, this also matters in day-to-day work: an employee connecting remotely through a VPN could encounter a mistaken block on a service the business depends on.

What you can do now

• Check what websites see. Visit the What is my IP address page with and without your VPN, and make sure the address changes.
• Get to know your device settings. Alongside your address, websites can check details sent by your browser and device. Review the privacy settings in your browser and on your device from time to time so you know what they share.
• Decide in advance what to do if you are blocked. If a website asks you to turn off your VPN while you are on a public network, it is better to wait until you can connect to a network you trust. In the meantime, keep the protection on.
• Limit the information you provide for age verification. Before uploading an identity document, look for the website’s statement on data retention and deletion. If there is no such statement, think carefully before continuing.
• Ask your VPN provider direct questions: Are the server and address shared or dedicated? What data is kept, and for how long? What does the provider block, and can you see the blocklist? Where is the company registered, and who owns it? Does the provider publish a statement about government requests for data?
• For businesses: Make sure employees have an alternative, secure way to access essential systems if they encounter a mistaken block.

How nuVPN helps

• Your own server and IP address. At nuVPN, every customer on a dedicated plan gets a private server and a static IP address that only they use. Websites see your server’s address, while your real address stays hidden. The address is clean, stable, and used only by you.
• DNS inside the tunnel. All DNS queries pass through the encrypted tunnel, so your internet service provider never sees which websites you visit.
• A detailed account of what is kept. The Transparency page provides an exhaustive list of the data nuVPN keeps: your email address and account details; daily traffic totals for billing, automatically deleted after 90 days; and payment status from the payment processor. The No-logs policy is enforced in code, not just stated in a policy document. This keeps your browsing history, DNS queries, and traffic content yours.
• Visible filtering. nuDefend protection, included in every plan, blocks known phishing, malware, and scam websites, as well as addresses associated with known attackers. Legitimate tools such as Google Analytics continue to work as usual. Your account area shows the number of threats blocked for you.
• Who runs the service. nuVPN is operated by a private Israeli company, registered since 2017. The company is wholly owned by its founder, a network and security engineer. The Transparency page also publishes a Warrant canary, last checked on 19 August 2026. The statement says that, as of that date, no government requests for user data had been received. If the statement disappears, it is worth asking about it.

The bottom line

Utah’s proposed rules seek to identify you through details sent by your device. The federal bill seeks to require your provider to filter websites. Both are still proposals, and there is no need for alarm. A VPN protects your address and encrypts your traffic. Alongside that protection, it is worth understanding the details your device sends, keeping the protection on when using a public network even if you encounter a block, and choosing a provider that clearly explains what it keeps and what it filters.