

Not web sites. Service providers. They mean ISPs. They aren’t holding pornhub liable if you use a VPN and are located in Utah.
The law is also technically flawed, given that it assumes that a web provider can reliably detect VPN traffic and determine a user’s true physical location — they can’t. IP reputation databases such as MaxMind and IP2Proxy can flag traffic from known datacenter IP ranges, but commercial VPN providers rotate addresses constantly, and residential VPN endpoints are largely indistinguishable from standard home connections. Autonomous System Number analysis can catch traffic originating from datacenter networks, but can’t identify a personal WireGuard tunnel running on a cloud VPS, for example, which routes through the same infrastructure as ordinary web hosting.









Only business that would require an ID/Age Verification check, but yeah. Except they don’t want to hold actual websites liable. They want to hold ISP’s liable.
There’s literally no way to know if the people using the VPN’s are located in Utah. So this law would be unenforceable against actual websites.
It might possibly be enforceable against ISP’s but the problem is, once you fire up a VPN your ISP can only see you entry point and maybe that there is a Volume of traffic going to and from your device. They can’t see what websites you visit (provided your VPN is properly configured).
I also don’t understand how this bill could effectively lay any blame against the websites for knowing you use a VPN because they also can’t see any of that information. They know that you visited and from a specific IP “located” in “place” and they can either assume that the use of a VPN means you’re in Utah (very unlikely), or they can assume you’re not (more likely given the population that lives outside Utah).