r/vpnet

Utah Senate Bill 73 takes effect tomorrow, May 6, 2026. It is the first US state law that specifically restricts VPN use, and it does so in two ways:

1. Anyone physically in Utah is treated as a Utah user for age-verification purposes, regardless of what their IP address says. The website carries the legal risk if it guesses wrong.
2. Covered websites are barred from telling visitors how to use a VPN to bypass age checks. The EFF has flagged this as a First Amendment concern.

The EFF has called it a "liability trap" because there is no reliable way for a website to detect VPN traffic and pinpoint a user's actual physical location. The only systems that come close are China's Great Firewall and Russia's TSPU. The likely outcomes: sites either block every known VPN IP, or force every visitor on Earth into an ID check.

Wisconsin tried something similar earlier in 2026 and walked it back. The UK and France have signaled they want to move in the same direction.

We put together a map of where every US state currently stands and a full breakdown of what SB 73 actually does: https://s.vp.net/ot4Is

EDIT 5/7: Great news! The law in Utah has been blocked temporarily!
https://www.sltrib.com/news/politics/2026/05/06/why-utah-now-requires-porn/

The California Attorney General announced this week that GM agreed to a $12.75 million settlement over a four-year practice (2020 to 2024) of selling names, contact information, precise geolocation, and driving behavior of hundreds of thousands of California drivers to two data brokers: Verisk Analytics and LexisNexis Risk Solutions. The brokers built a driver-rating product out of the data and sold it to auto insurers, who then used it to raise premiums for drivers in states where that's legal. Nationwide, GM made roughly $20 billion off this category of data sharing.

A few details worth knowing:

• California drivers weren't hit with rate hikes because state law blocks insurers from using driving data to set premiums. Drivers in other states paid for it.
• GM has 180 days to delete the data, request the same of the brokers, and stay out of the consumer reporting agency business for five years.
• This is the 8th CCPA enforcement action under AG Bonta and the first one to use the 2023 data minimization rule.

The brokers themselves haven't been named in any enforcement action, only the source of the data. Should the brokers be on the hook too, or is GM the right pressure point when the data originated with them?

Full breakdown with all source links here: https://s.vp.net/6nTTy

Connecticut's SB 4 cleared the House 141 to 6 and the Senate 31 to 4 back on April 23rd. Governor Lamont is expected to sign. It's being described as the strongest state privacy bill in years, and the specifics back that up.

Key provisions:

• State-run registry of data brokers operating in Connecticut
• A single deletion request mechanism that wipes a resident's data from every registered broker at once
• Ban on the sale of precise geolocation data
• Restrictions on the sharing of automated license plate reader information
• Mandatory disclosure of facial recognition use in public spaces
• Mandatory disclosure of algorithmic surveillance pricing

The unusual part is the sponsor's framing. Senator James Maroney, the lead sponsor, said the bill protects residents from data brokers, surveillance technology companies, and federal agencies. Naming federal agencies as a threat category in a state privacy bill is not standard. Most state laws stop at private-sector data handling.

The interesting question is whether the deletion mechanism actually works at scale once brokers are registered. California's Delete Act has a similar concept and the implementation has been slow. Connecticut's bill borrows from that playbook but adds the federal-agency language on top.

Full Write-Up & Source list here: https://s.vp.net/3Cfh9

A Swiss flag is not a firewall.

If a provider can log your IP address to 'monitor for abuse,' they can log it for a court order. If they can monitor a mailbox for 'safety,' they can monitor it for a government. They are not villains. They are administrators operating under whichever set of laws applies this week.

In 2021, Swiss authorities ordered ProtonMail to log a user's IP. ProtonMail complied. The architecture permitted it. Switzerland, it turned out, was a jurisdiction, not a guarantee.

bmail's API gateway runs inside an Intel SGX enclave. Client IP addresses are processed in hardware-isolated memory and never written to any storage. There is nothing to log because the architecture never permitted it.

Physically protected by hardware, not imaginary lines.