EFF to Wisconsin Legislature: VPN Bans Are Still a Terrible Idea

"The short version? This bill both requires invasive age verification for websites that host content lawmakers might deem "sexual" and requires that those sites block any user that connects via a Virtual Private Network (VPN). VPNs are a basic cybersecurity tool used by businesses, universities, journalists, veterans, abuse survivors, and ordinary people who simply don't want to broadcast their location to every website they visit."

"As we lay out in the letter, Wisconsin's mandate is technically unworkable. Websites cannot reliably determine whether a VPN user is in Wisconsin, a different state, or a different country. So, to avoid liability, websites are faced with an unfortunate choice: either resort to over-blocking IP addresses commonly associated with commercial VPNs, block all Wisconsin users' access, or mandate nationwide restrictions just to avoid liability."

"The bill also creates a privacy nightmare. It pushes websites to collect sensitive personal data (e.g. government IDs, financial information, biometric identifiers) just to access lawful speech. At the same time, it broadens the definition of material deemed "harmful to minors" far beyond the narrow categories courts have historically allowed states to regulate. The definition goes far beyond the narrow categories historically recognized by courts (namely, explicit adult sexual materials) and instead sweeps in material that merely describes sex or depicts human anatomy."

The bill requires invasive age verification for websites hosting content lawmakers might label sexual and mandates blocking any user who connects via a VPN. VPNs serve legitimate security, privacy, and safety functions for businesses, institutions, journalists, veterans, abuse survivors, and everyday users. Websites cannot reliably determine whether a VPN user is located in Wisconsin, another state, or another country, forcing sites either to over-block VPN-associated IPs, deny all Wisconsin access, or impose nationwide restrictions. The bill pushes sites to collect sensitive personal data and expands the definition of material harmful to minors to include mere descriptions of sex or anatomy, inviting over-blocking and censorship of lawful speech.

Read at Electronic Frontier Foundation