https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpns-and-they-have-no-idea-what-theyre-doing Skip to main content * About + Contact + Press + People + Opportunities + EFF's 35th Anniversary * Issues + Free Speech + Privacy + Creativity and Innovation + Transparency + International + Security * Our Work + Deeplinks Blog + Press Releases + Events + Legal Cases + Whitepapers + Podcast + Annual Reports * Take Action + Action Center + Electronic Frontier Alliance + Volunteer * Tools + Privacy Badger + Surveillance Self-Defense + Certbot + Atlas of Surveillance + Cover Your Tracks + Street Level Surveillance + apkeep * Donate + Donate to EFF + Giving Societies + Shop + Sponsorships + Other Ways to Give + Membership FAQ * Donate + Donate to EFF + Shop + Other Ways to Give * Search form Search [ ] --------------------------------------------------------------------- Email updates on news, actions, and events in your area. Join EFF Lists * Copyright (CC BY) * Trademark * Privacy Policy * Thanks Electronic Frontier Foundation Donate Electronic Frontier Foundation * About + Contact + Press + People + Opportunities + EFF's 35th Anniversary * Issues + Free Speech + Privacy + Creativity and Innovation + Transparency + International + Security * Our Work + Deeplinks Blog + Press Releases + Events + Legal Cases + Whitepapers + Podcast + Annual Reports * Take Action + Action Center + Electronic Frontier Alliance + Volunteer * Tools + Privacy Badger + Surveillance Self-Defense + Certbot + Atlas of Surveillance + Cover Your Tracks + Street Level Surveillance + apkeep * Donate + Donate to EFF + Giving Societies + Shop + Sponsorships + Other Ways to Give + Membership FAQ * Donate + Donate to EFF + Shop + Other Ways to Give * Search form Search [ ] Lawmakers Want to Ban VPNs--And They Have No Idea What They're Doing DEEPLINKS BLOG By Rindala Alajaji November 13, 2025 [student-pr] Lawmakers Want to Ban VPNs--And They Have No Idea What They're Doing Share It Share on Mastodon Share on Twitter Share on Facebook Copy link [student-privacy-2-og] Remember when you thought age verification laws couldn't get any worse? Well, lawmakers in Wisconsin, Michigan, and beyond are about to blow you away. It's unfortunately no longer enough to force websites to check your government-issued ID before you can access certain content, because politicians have now discovered that people are using Virtual Private Networks (VPNs) to protect their privacy and bypass these invasive laws. Their solution? Entirely ban the use of VPNs. Yes, really. As of this writing, Wisconsin lawmakers are escalating their war on privacy by targeting VPNs in the name of "protecting children" in A.B. 105/S.B. 130. It's an age verification bill that requires all websites distributing material that could conceivably be deemed "sexual content" to both implement an age verification system and also to block the access of users connected via VPN. The bill seeks to broadly expand the definition of materials that are "harmful to minors" beyond the type of speech that states can prohibit minors from accessing--potentially encompassing things like depictions and discussions of human anatomy, sexuality, and reproduction. This follows a notable pattern: As we've explained previously, lawmakers, prosecutors, and activists in conservative states have worked for years to aggressively expand the definition of "harmful to minors" to censor a broad swath of content: diverse educational materials, sex education resources, art, and even award-winning literature. Wisconsin's bill has already passed the State Assembly and is now moving through the Senate. If it becomes law, Wisconsin could become the first state where using a VPN to access certain content is banned. Michigan lawmakers have proposed similar legislation that did not move through its legislature, but among other things, would force internet providers to actively monitor and block VPN connections. And in the UK, officials are calling VPNs "a loophole that needs closing." This is actually happening. And it's going to be a disaster for everyone. Here's Why This Is A Terrible Idea VPNs mask your real location by routing your internet traffic through a server somewhere else. When you visit a website through a VPN, that website only sees the VPN server's IP address, not your actual location. It's like sending a letter through a P.O. box so the recipient doesn't know where you really live. So when Wisconsin demands that websites "block VPN users from Wisconsin," they're asking for something that's technically impossible. Websites have no way to tell if a VPN connection is coming from Milwaukee, Michigan, or Mumbai. The technology just doesn't work that way. Websites subject to this proposed law are left with this choice: either cease operation in Wisconsin, or block all VPN users, everywhere, just to avoid legal liability in the state. One state's terrible law is attempting to break VPN access for the entire internet, and the unintended consequences of this provision could far outweigh any theoretical benefit. Almost Everyone Uses VPNs Let's talk about who lawmakers are hurting with these bills, because it sure isn't just people trying to watch porn without handing over their driver's license. 1. Businesses run on VPNs. Every company with remote employees uses VPNs. Every business traveler connecting through sketchy hotel Wi-Fi needs one. Companies use VPNs to protect client and employee data, secure internal communications, and prevent cyberattacks. 2. Students need VPNs for school. Universities require students to use VPNs to access research databases, course materials, and library resources. These aren't optional, and many professors literally assign work that can only be accessed through the school VPN. The University of Wisconsin-Madison's WiscVPN, for example, "allows UW-Madison faculty, staff and students to access University resources even when they are using a commercial Internet Service Provider (ISP)." 3. Vulnerable people rely on VPNs for safety. Domestic abuse survivors use VPNs to hide their location from their abusers. Journalists use them to protect their sources. Activists use them to organize without government surveillance. LGBTQ+ people in hostile environments--both in the US and around the world--use them to access health resources, support groups, and community. For people living under censorship regimes, VPNs are often their only connection to vital resources and information their governments have banned. 4. Regular people just want privacy. Maybe you don't want every website you visit tracking your location and selling that data to advertisers. Maybe you don't want your internet service provider (ISP) building a complete profile of your browsing history. Maybe you just think it's creepy that corporations know everywhere you go online. VPNs can protect everyday users from everyday tracking and surveillance. It's A Privacy Nightmare Here's what happens if VPNs get blocked: everyone has to verify their age by submitting government IDs, biometric data, or credit card information directly to websites--without any encryption or privacy protection. We already know how this story ends. Companies get hacked. Data gets breached. And suddenly your real name is attached to the websites you visited, stored in some poorly-secured database waiting for the inevitable leak. This has already happened, and is not a matter of if but when. And when it does, the repercussions will be huge. Forcing people to give up their privacy to access legal content is the exact opposite of good policy. It's surveillance dressed up as safety. "Harmful to Minors" Is Not a Catch-All Here's another fun feature of these laws: they're trying to broaden the definition of "harmful to minors" to sweep in a host of speech that is protected for both young people and adults. Historically, states can prohibit people under 18 years old from accessing sexual materials that an adult can access under the First Amendment. But the definition of what constitutes "harmful to minors" is narrow -- it generally requires that the materials have almost no social value to minors and that they, taken as a whole, appeal to a minors' "prurient sexual interests." Wisconsin's bill defines "harmful to minors" much more broadly. It applies to materials that merely describe sex or feature descriptions /depictions of human anatomy. This definition would likely encompass a wide range of literature, music, television, and films that are protected under the First Amendment for both adults and young people, not to mention basic scientific and medical content. Additionally, the bill's definition would apply to any websites where more than one third of the site's material is "harmful to minors." Given the breadth of the definition and its one-third trigger, we anticipate that Wisconsin could argue that the law applies to most social media websites. And it's not hard to imagine, as these topics become politicised, Wisconsin claiming it applies to websites containing LGBTQ+ health resources, basic sexual education resources, and reproductive healthcare information. This breadth of the bill's definition isn't a bug, it's a feature. It gives the state a vast amount of discretion to decide which speech is "harmful" to young people, and the power to decide what's "appropriate" and what isn't. History shows us those decisions most often harm marginalized communities. It Won't Even Work Let's say Wisconsin somehow manages to pass this law. Here's what will actually happen: People who want to bypass it will use non-commercial VPNs, open proxies, or cheap virtual private servers that the law doesn't cover. They'll find workarounds within hours. The internet always routes around censorship. Even in a fantasy world where every website successfully blocked all commercial VPNs, people would just make their own. You can route traffic through cloud services like AWS or DigitalOcean, tunnel through someone else's home internet connection, use open proxies, or spin up a cheap server for less than a dollar. Meanwhile, everyone else (businesses, students, journalists, abuse survivors, regular people who just want privacy) will have their VPN access impacted. The law will accomplish nothing except making the internet less safe and less private for users. Nonetheless, as we've mentioned previously, while VPNs may be able to disguise the source of your internet activity, they are not foolproof--nor should they be necessary to access legally protected speech. Like the larger age verification legislation they are a part of, VPN-blocking provisions simply don't work. They harm millions of people and they set a terrifying precedent for government control of the internet. More fundamentally, legislators need to recognize that age verification laws themselves are the problem. They don't work, they violate privacy, they're trivially easy to circumvent, and they create far more harm than they prevent. A False Dilemma People have (predictably) turned to VPNs to protect their privacy as they watched age verification mandates proliferate around the world. Instead of taking this as a sign that maybe mass surveillance isn't popular, lawmakers have decided the real problem is that these privacy tools exist at all and are trying to ban the tools that let people maintain their privacy. Let's be clear: lawmakers need to abandon this entire approach. The answer to "how do we keep kids safe online" isn't "destroy everyone's privacy." It's not "force people to hand over their IDs to access legal content." And it's certainly not "ban access to the tools that protect journalists, activists, and abuse survivors." If lawmakers genuinely care about young people's well-being, they should invest in education, support parents with better tools, and address the actual root causes of harm online. What they shouldn't do is wage war on privacy itself. Attacks on VPNs are attacks on digital privacy and digital freedom. And this battle is being fought by people who clearly have no idea how any of this technology actually works. If you live in Wisconsin--reach out to your Senator and urge them to kill A.B. 105/S.B. 130. Our privacy matters. VPNs matter. And politicians who can't tell the difference between a security tool and a "loophole" shouldn't be writing laws about the internet. Related Issues Age Verification and Age Gating Share It Share on Mastodon Share on Twitter Share on Facebook Copy link Join EFF Lists Discover more. Email updates on news, actions, events in your area, and more. Email Address [ ] Postal Code (optional) [ ] Anti-spam question: Enter the three-letter abbreviation for Electronic Frontier Foundation: [ ] Don't fill out this field (required) [ ] [Submit] Thanks, you're awesome! Please check your email for a confirmation link. Oops something is broken right now, please try again later. Related Updates [mobile-privacy-knight-2_0] Deeplinks Blog by Molly Buckley | November 14, 2025 A Surveillance Mandate Disguised As Child Safety: Why the GUARD Act Won't Keep Us Safe A new bill sponsored by Sen. Hawley (D-MO), Sen. Blumenthal (D-CT), Sen. Britt (R-AL), Sen. Warner (D-VA), and Sen. Murphy (D-CT) would require AI chatbots to verify all users' ages, prohibit minors from using AI tools, and implement steep criminal penalties for chatbots that promote or solicit certain harms. That... Purple padlock with an 18+ only symbol and a combination lock requiring day of birth. Deeplinks Blog by Rindala Alajaji | October 30, 2025 Age Verification, Estimation, Assurance, Oh My! A Guide to the Terminology Age verification, age assurance, age estimation, age gating--they get thrown around interchangeably, but they technically mean different things. And those differences matter a lot when we're talking about your rights, your privacy, your data, and who gets to access information online. So let's clear up the confusion. Here's your guide... Purple padlock with an 18+ only symbol and a combination lock requiring Day, Month, and Year. Deeplinks Blog by Molly Buckley | September 5, 2025 Age Verification Is A Windfall for Big Tech--And A Death Sentence For Smaller Platforms If you live in Mississippi, you may have noticed that you are no longer able to log into your Bluesky or Dreamwidth accounts from within the state. That's because, in a chilling early warning sign for the U.S., both social platforms decided to block all users in Mississippi from their... Purple padlock with an 18+ only symbol and a combination lock requiring Day, Month, and Year. Deeplinks Blog by Rindala Alajaji, Jason Kelley | August 18, 2025 From Book Bans to Internet Bans: Wyoming Lets Parents Control the Whole State's Access to The Internet If you've read about the sudden appearance of age verification across the internet in the UK and thought it would never happen in the U.S., take note: many politicians want the same or even more strict laws. As of July 1st, South Dakota and Wyoming enacted laws requiring... A multi-colored bullhorn icon surrounded by grey-blue hexagons Deeplinks Blog by Molly Buckley | August 8, 2025 Americans, Be Warned: Lessons From Reddit's Chaotic UK Age Verification Rollout Now that the Online Safety Act has gone into effect, countless problems have begun to reveal themselves, and the absurd, disastrous outcome illustrates why we must work to avoid this age-verified future at all costs. Purple padlock with an 18+ only symbol and a combination lock requiring Day, Month, and Year. Deeplinks Blog by Paige Collings | August 5, 2025 Blocking Access to Harmful Content Will Not Protect Children Online, No Matter How Many Times UK Politicians Say So The UK is having a moment. In late July, new rules took effect that require all online services available in the UK to assess whether they host content considered harmful to children, and if so, these services must introduce age checks to prevent children from accessing such content.... Purple padlock with an 18+ only symbol and a combination lock requiring Day, Month, and Year. Deeplinks Blog by Paige Collings | August 1, 2025 No, the UK's Online Safety Act Doesn't Make Children Safer Online Young people should be able to access information, speak to each other and to the world, play games, and express themselves online without the government making decisions about what speech is permissible. But in one of the latest misguided attempts to protect children online, internet users of all ages... EU-flag-circuits Deeplinks Blog by Svea Windwehr, Jillian C. York, Christoph Schmon | July 28, 2025 Just Banning Minors From Social Media Is Not Protecting Them By publishing its guidelines under Article 28 of the Digital Services Act, the European Commission has taken a major step towards social media bans that will undermine privacy, expression, and participation rights for young people that are already enshrined in international human rights law. EFF recently submitted feedback... Mobile ID digital license Deeplinks Blog by Alexis Hancock, Paige Collings | July 25, 2025 Zero Knowledge Proofs Alone Are Not a Digital ID Solution to Protecting User Privacy In the past few years, governments across the world have rolled out digital identification options, and now there are efforts encouraging online companies to implement identity and age verification requirements with digital ID in mind. This blog is the first in this short series that will... [OG-Encryption-DefendEncryption] Deeplinks Blog by David Greene, Christoph Schmon | July 17, 2025 We Support Wikimedia Foundation's Challenge to UK's Online Safety Act The Electronic Frontier Foundation and ARTICLE 19 strongly support the Wikimedia Foundation's legal challenge to the categorization regulations of the United Kingdom's Online Safety Act.The Foundation - the non-profit that operates Wikipedia and other Wikimedia projects - announced its legal challenge... Back to top EFF Home Follow EFF: * mastodon * facebook * instagram * x * Blue Sky * youtube * flicker * linkedin * tiktok * threads Check out our 4-star rating on Charity Navigator. Contact * General * Legal * Security * Membership * Press About * Calendar * Volunteer * Victories * History * Internships * Jobs * Staff * Diversity & Inclusion Issues * Free Speech * Privacy * Creativity & Innovation * Transparency * International * Security Updates * Blog * Press Releases * Events * Legal Cases * Whitepapers * EFFector Newsletter Press * Press Contact Donate * Join or Renew Membership Online * One-Time Donation Online * Giving Societies * Corporate Giving and Sponsorship * Shop * Other Ways to Give * Copyright (CC BY) * Trademark * Privacy Policy * Thanks JavaScript license information *