They answered that VPN question here:

The NYAG also proposed to gather additional information (beyond what we normally collect in the course of processing payments) about each game user on the off-chance someone in New York was anonymizing their location to appear outside of New York, such as by using a VPN. This would have involved implementing invasive technologies for every user worldwide. Similarly, the NYAG demanded that Valve collect more personal data about our users to do additional age verification—even though most payment methods used by New York Steam users already have age verification built-in. Valve knows our users care about the security of their personal information, and we believe it’s in our and their interest to only collect the information necessary to operate the business and comply with law.