Ok, so basically when your computer uses a VPN it just connects to a VPN server over the Internet using an encrypted TCP/IP or UDP/IP connection. On your computer side all your connections to the Internet just get shoved into that encrypted tunel instead of going directly into the whole wide world from your own network connection so nobody but that server sees those connections, whilst on the VPN server side they’re recieved from that tunel and then exit to the whole wide world from that VPN server as if they’re actually connections initiated by that, so nobody else but that server knows that they are in fact connections you via an encrypted tunel.

Nations with nation-wide firewalls can try and block VPN by blocking the actual encrypted network connections to VPN servers (there are ways to recognize those, but there also ways to disguise them), but for websites to block them (which is what this legislation demands) the websites have to block the actual VPN servers since they have no way to know whose really behind those connections as all the sites see is connections which seem to originate in those servers as they have only the power to interfere with the traffic coming to them, not traffic elsewhere on the Internet (such as the encrypted connections from customers of VPNs)

Now, there are lists of the IP addresses of the exist points of VPN providers, which are the IP addresses were the traffic of somebody using that VPN enters the Internet, so to try to comply with this legislation those sites would start by blocking all traffic from any of those IP addresses - remember those websites don’t know were the traffic coming from a VPN server to that website really comes from, so they can’t tell traffic from people in Wisconsin from traffic from people elsewhere hence have to block everything to catch everybody from Winsonsin.

This would affect everybody anywhere in the World using those exit points of those VPN providers since those sites can’t really tell where exactly in the World is somebody whose traffic is coming from those VPN exit points.

Then there’s the problem that the legislation applies to all VPNs, not just commercial VPN providers, meaning that the websites would also theoretically have to block VPN servers from business VPNs (and given how the networks of many large companies work, that might mean blocking the entire company) as well as thing like schools using VPNs and, even more entertaining, VPNs set up by individuals by, for example, renting a Virtual Private Server and installing a Linux there running their own VPN server or even installing the VPN server software on something like Amazon AWS or Microsoft Azure, which mean they might have to block every single IP address of any provider of VPS servers anywhere in the World (as any Wisconsian could, theoretically, over the Internet rent a chea VPS in, say, Malasia, and install a Linux with a VPS server there) as well as of all AWS and Azure servers since again any Wisconsian could theoretically run their own personal VPS server there.

So this legislation is totally insane in several ways.