Wisconsin Could Become the First State to Ban VPNs. Here Is Why That Matters

The Bill

Wisconsin's Senate Bill 130 and its companion Assembly Bill 105 were introduced as age verification legislation, part of a nationwide wave of bills aimed at restricting minors' access to certain online content. The bill passed the State Assembly and was scheduled for a Senate vote on February 18, 2026.

But buried in the age verification requirements is a provision that goes far beyond protecting children. The bill requires websites to block any user connecting through a Virtual Private Network (VPN). If it passes, Wisconsin would become the first state in the country to effectively ban VPN access to certain websites.

What It Would Actually Do

The legislation requires websites hosting content that lawmakers deem "sexual" to verify every visitor's age using government issued identification, financial records, or biometric data. Any website that fails to do so faces legal liability.

The VPN ban is the enforcement mechanism. Because a VPN masks a user's location, websites cannot determine whether a visitor is in Wisconsin or any other state. Rather than solving this technical limitation, the bill simply requires websites to block all VPN traffic entirely.

This means the bill does not just affect people accessing restricted content. It affects anyone using a VPN for any reason, including:

• Remote workers: Millions of employees use corporate VPNs to connect to their employer's network securely
• Journalists: VPNs protect reporters working on sensitive stories from surveillance and source identification
• Abuse survivors: VPNs help domestic violence survivors browse the internet without their location being tracked
• Travelers: VPNs protect financial transactions and personal data on public WiFi networks
• Privacy conscious users: Anyone who simply does not want their ISP logging every website they visit

Why VPN Bans Are Technically Unworkable

The Electronic Frontier Foundation sent a letter to the entire Wisconsin Legislature urging lawmakers to reject the bill, describing it as "a spectacularly bad idea." The EFF's core argument is that the mandate is technically impossible to implement reliably.

Websites cannot reliably determine whether a user is connecting through a VPN. While some VPN detection services exist, they produce false positives and false negatives regularly. A determined user can bypass VPN detection by switching providers, using residential proxy services, or connecting through Tor.

More fundamentally, websites cannot determine whether a VPN user is in Wisconsin, another state, or another country. The bill would effectively require websites to block VPN users worldwide to comply with one state's law, a jurisdictional overreach that raises serious constitutional questions.

The Privacy Cost

The age verification requirement creates a surveillance database by design. To comply, websites must collect government IDs, financial information, or biometric identifiers from every visitor. This data must be stored somewhere, creating a high value target for hackers.

The irony is hard to miss. A bill framed as protecting children from harmful content would create a system that collects and stores the most sensitive personal data imaginable, including government identification documents and biometric profiles, from every adult who visits an affected website.

Data breaches at age verification providers have already occurred. In 2025, a breach at a third party verification service exposed ID photos and personal details for tens of thousands of users. The more websites are forced to collect identity documents, the more breach targets exist.

The Precedent Problem

If Wisconsin passes this bill, it sets a precedent for other states to follow. Several states have already introduced or passed age verification laws, but none have included VPN blocking provisions. Wisconsin's bill could normalize the idea that governments can ban privacy tools to enforce content regulations.

The progression is predictable. First, VPN bans for age verification. Then VPN restrictions for copyright enforcement. Then requirements that ISPs block VPN protocols entirely. Each step makes the next one easier to justify politically, even as the technical and privacy costs escalate.

Countries that have banned or restricted VPN use include China, Russia, Iran, and North Korea. Adding a U.S. state to that list, even for a narrow category of websites, sends a message about the direction of American internet policy.

What You Can Do

If you live in Wisconsin, contact your state senator before the vote. The EFF has published a tool to help constituents find their representatives and send messages opposing the bill.

Regardless of where you live, this bill matters. Privacy tools like VPNs protect everyone from surveillance, data collection, and tracking. Normalizing bans on privacy tools anywhere makes them vulnerable everywhere.

• Use a VPN consistently, not just when you think you need one. Routine use makes VPN traffic harder to single out
• Support organizations like the EFF that fight legislation threatening digital privacy rights
• Talk to people who do not use VPNs about why they should. The more people use privacy tools, the harder it becomes to ban them politically

A VPN is not a tool for hiding. It is a tool for maintaining the basic expectation that your internet activity is not broadcast to your ISP, your government, and every website you visit. Wisconsin's bill treats privacy as something to prohibit rather than protect.