Utah Enacts First State Law Targeting VPN Use to Enforce Online Age Verification

On May 6 2026, Utah’s Online Age Verification Amendments (SB 73), signed by Governor Spencer Cox on March 19 2026, become law. The statute makes adult-content sites liable for failing to age-verify any user physically in Utah, even when a VPN masks the user’s location.

Electronic Frontier Foundation

Age-verification mandates exist in states like Florida, Missouri, Texas and in countries such as the United Kingdom, Australia, and Indonesia, and have consistently driven VPN usage spikes. A comparable Wisconsin proposal was withdrawn after backlash, making Utah’s bill the first U.S. measure to target VPNs directly.

Electronic Frontier Foundation

Section 14 amends Utah code to treat a user as located in the state regardless of VPN, proxy, or other masking tools. It also prohibits commercial entities hosting “a substantial portion of material harmful to minors” from providing VPN instructions or facilitating circumvention. The law does not ban VPN use outright but creates a liability trap for non-compliant sites.

TechRadar

Blocking known VPN and proxy IPs needs a constantly updated list—a “technical whack-a-mole” that providers cannot win. Companies may ban VPN IPs or impose universal age checks, potentially forcing millions into invasive verification. The requirement also risks collateral damage to journalists, abuse survivors, and businesses that depend on commercial VPNs for security.

Electronic Frontier FoundationTechRadar

Governor Spencer Cox signed SB 73, saying it protects minors. The Electronic Frontier Foundation warned that the “don’t ask, don’t tell” enforcement raises First-Amendment concerns and is technically unfeasible. NordVPN called the law an “unresolvable compliance paradox” and a “liability trap.” The Cato Institute argued the policy may be misdirected when a common privacy tool can bypass it.

TechRadar

Civil-rights groups say the law infringes free speech by barring platforms from sharing truthful VPN information. The UK Children’s Commissioner called VPNs a “loophole that needs closing,” and the French Minister Delegate for Artificial Intelligence and Digital Affairs called them “the next topic on my list.” Proton CEO Andy Yen warned that such age-verification proposals “would mean the death of anonymity online.”

Electronic Frontier Foundation

Sources differ on whether SB 73 explicitly bans VPN use; some describe a “don’t ask, don’t tell” approach that merely discourages VPNs, while others cite a direct prohibition on providing VPN instructions. No detailed enforcement guidelines have been released.

Electronic Frontier Foundation

• “As the Cato Institute states: “The point is that when an internet policy can be avoided by a relatively common technology that often provides significant privacy and security benefits, maybe the policy is the problem.” — Cato Institute

Electronic Frontier Foundation

• “loophole that needs closing” — UK Children’s Commissioner

Electronic Frontier Foundation

• “the next topic on my list” — French Minister Delegate for Artificial Intelligence and Digital Affairs

Electronic Frontier Foundation

• “ Ultimately, NordVPN states: "It is a liability trap.” — NordVPN

TechRadar