A new internet law in Utah is unlike anything the US has seen before. Starting May 6, 2026, adult websites must verify the age of anyone physically located in the state, and a VPN will not reliably get around it.
That is the core shift. Until now, using a VPN to appear as though you were browsing from another state or country worked because most systems relied on IP-based location. Utah’s Senate Bill 73 changes that by tying enforcement to physical presence instead.
The law was signed by Governor Spencer Cox on March 19, 2026 and takes effect May 6, ahead of a separate 2% tax on adult content revenue that begins in October.
Civil liberties groups are calling it a dangerous precedent. The VPN industry says it is technically unenforceable. Users in Utah are now caught in the middle.
TL;DR: Utah’s SB 73 takes effect on May 6, making it the first US state to directly target VPN use in age verification law. Adult websites must now verify the age of anyone physically in Utah, regardless of VPN use. Websites face legal liability, not individual users. Critics call enforcement technically impossible, and some sites may simply block Utah access entirely.
What Utah’s VPN age verification law actually says
According to Utah’s official enrolled Senate Bill 73, formally titled the Online Age Verification Amendments, does two things in its VPN-related section.
- First, it redefines how location is determined. Under the law, you are considered to be accessing a website from Utah if you are physically there, full stop. It does not matter if your IP address suggests you are in Nevada or the Netherlands.
- Second, it prohibits websites that host content harmful to minors from providing instructions or encouragement around using a VPN to bypass age checks. That means a platform cannot even tell you to try a VPN.
The Electronic Frontier Foundation has flagged this as a significant First Amendment concern, since it restricts platforms from sharing truthful information about a legal privacy tool.
VPNs themselves are not banned. You can still use one. But because liability now sits with the website and not the user, the practical value of a VPN for bypassing age gates is considerably weakened.
Who is actually on the hook here
This is where things get complicated for websites, not just users.
Under SB 73, adult platforms remain legally liable for age verification failures even when a visitor uses a VPN to mask their location. If a site fails to comply, it faces penalties from Utah’s Division of Consumer Protection.
The introduced version of the bill included a $1,000 per day penalty for failure to provide required age verification notification, though the specific penalties in the final enrolled bill should be confirmed through official Utah legislative sources.
NordVPN called this an “unresolvable compliance paradox” and a “liability trap.” The EFF agreed, describing the requirement as something “likely no company can win.” The law does not clearly define how enforcement applies when a site has no way of knowing a user is physically in Utah, which leaves a significant gray zone at the center of the policy.
What this means if you are in Utah
If you live in or are visiting Utah, how platforms respond to SB 73 will determine what you actually experience.
Some sites may require identity verification from all visitors globally, rather than risk a Utah user slipping through. Others may block known commercial VPN IP ranges. The most likely outcome for smaller platforms is the simplest one: geo-block Utah entirely and stop serving users there.
This has already happened. When similar age verification laws passed in other states, Pornhub chose to block access from those states rather than build compliance infrastructure. Users hit a wall regardless of whether they had a VPN. That precedent makes total geo-blocking the realistic response for many operators.
For privacy-focused users who rely on VPNs for general security and anonymity, and not specifically to bypass restrictions, the practical impact is still indirect. VPNs remain legal and fully functional for encrypting traffic, protecting data on public Wi-Fi, and preventing ISP tracking. What changes is how websites are expected to treat VPN-connected traffic from Utah.
The privacy problem critics are raising
Because adult content is highly sensitive, many users have a strong interest in keeping that browsing private. Age verification, in practice, requires submitting government ID, biometric data, or third-party verification credentials. That data gets stored, processed, and in many cases handed to a verification provider separate from the platform itself.
Mandatory ID submission creates a permanent record of who accessed what. Data breaches in this space have happened before, and the consequences are considerably more personal than having your email leaked from a retail loyalty program.
The EFF has argued that laws like SB 73 do not actually keep children safer in any meaningful way. Kids who want to access restricted content have many routes that do not involve a VPN. The compliance burden falls hardest on adults using legitimate privacy tools.
Features like a VPN kill switch exist because people want reliable, uninterrupted privacy protection. Laws that introduce legal uncertainty around VPN use affect those users most directly, even when the VPN itself remains perfectly legal.
Why enforcement is technically broken
The law assumes websites can reliably detect whether a user is physically in Utah. They cannot.
The standard tool for location detection is IP geolocation, and VPNs are specifically designed to defeat it. IP reputation databases like MaxMind and IP2Proxy can flag known datacenter IP ranges, but commercial VPN providers rotate addresses constantly.
Residential VPN endpoints are largely indistinguishable from standard home connections. Autonomous System Number analysis catches datacenter-routed traffic but misses a personal WireGuard tunnel running on a cloud server, which routes through the same infrastructure as ordinary web hosting.
The only detection method that reliably identifies VPN traffic is deep packet inspection at the network level. China’s Great Firewall and Russia’s TSPU system use exactly this, but it requires access to ISP-level infrastructure that sits between the user and the server.
A website operator simply cannot deploy it. So the law creates an obligation that cannot actually be met using any tool available to the platforms it governs.
The result, as NordVPN put it, is a law that “punishes lawful users who care about their privacy, globally,” while doing very little to stop a determined minor with a search engine and five minutes.
How this fits into a broader trend
Utah is not operating in isolation. Similar age verification laws have been advancing across the US and internationally.
Wisconsin considered a provision that would have banned VPNs outright for bypassing age checks, but pulled it after significant backlash. The UK’s House of Lords voted 207-159 in January 2026 on amendments that would ban VPN use for under-18s, with those provisions still moving through Parliament. France’s digital affairs minister publicly flagged VPNs as the next regulatory target.
Australia saw VPN usage increase by more than 1,400% on the first day age verification enforcement began there. The pattern is consistent: governments pass age-gating laws, users turn to VPNs, governments then try to close the VPN loophole. Utah has taken the first concrete US step in that cycle.
Should you still use a VPN?
Yes, with a clear understanding of what has and has not changed.
VPNs are still legal in Utah and everywhere else in the US. They still provide genuine privacy and security benefits. None of that is affected by SB 73. What has changed is how websites are legally expected to treat VPN users from Utah when it comes to age-restricted content.
If you use a VPN primarily for security on public networks, your workflow does not need to change. If you were relying on one specifically to bypass Utah’s existing age verification requirements, that workaround is now legally eroded, even if the technical reality is messier than the law implies.
Utah may be the first state to test this model, but it almost certainly will not be the last. And when other states follow with their own variations, the patchwork of conflicting rules will become a much bigger problem for both platforms and users than anything SB 73 creates on its own.
Frequently Asked Questions
Does Utah’s SB 73 make VPNs illegal?
No. VPNs remain legal in Utah and throughout the US. The law targets how websites must treat VPN-connected users for age verification purposes, not VPN use itself.
Who is liable under Utah’s age verification law, websites or users?
Websites and platforms hosting content deemed harmful to minors bear the legal liability, not individual users. If a site fails to verify age, it faces penalties from Utah’s Division of Consumer Protection.
Can websites just block all VPN traffic to comply?
Not reliably. VPN providers constantly add new IP addresses, residential VPN endpoints are indistinguishable from standard home connections, and deep packet inspection, the only method that works, requires ISP-level infrastructure that websites cannot access.
Will this law affect users outside Utah?
Potentially. Some platforms may apply age verification globally rather than try to detect Utah users specifically, which would affect visitors from other states and countries as well.
What age verification methods would sites likely use to comply?
Platforms would typically require government ID submission, biometric verification, or third-party age verification services. The specific method is left to the platform, but all involve collecting personal data from the user.
If you've any thoughts on Utah’s VPN age verification law takes effect May 6: What it actually changes, then feel free to drop in below comment box. Also, please subscribe to our DigitBin YouTube channel for videos tutorials. Cheers!
