

Legal, probably. Whichever corporations push that hypothetical bill are going to write it very specifically to ensure that it excludes their use cases.
Here’s an example of how they could do it:
S.A.V.E.K.I.D.S:
Support Age Verification Environments Keeping Internet Detectable SignalsBlah blah pretext and background information…
Blah blah surface-level purported reason for the bill is to prevent kids from bypassing age verification checks by using a VPN to pretend they’re a resident of another country…
No entity operating in or doing business within <jurisdiction> may provide services or make available technology that irreversibly redirects, masks, or otherwise obscures internet-destined traffic to appear as originating from any source other than the internet-connected network in which it was generated.
Site–to-site VPN? Fine, it’s destined for the intranet.
NAT? Also fine, it is the originating internet-connected network.
HTTP reverse proxies? Still fine, they pass the origin IP along.
VPN that routes all traffic through it? You’re getting locked up and they’re throwing away the key.

Most people with that little money aren’t going to go out of their way and assume the risk of investing in new ventures. They’re going to put it in some managed or unmanaged fund recommended by someone else, and that money is going to be invested in something safe and presumably profitable on an infinite time scale, like a megacorp (or 500).
It would amazing if the everyday worker’s savings went towards aiding the local community in starting new businesses, but I wouldn’t count on that being the default.