Utah becomes first US state to require age verification for VPN use

Utah is set to implement a first-of-its-kind law targeting VPN use to enforce online age verification, raising concerns about privacy, free speech, and technical feasibility.

The measure, which takes effect on May 6, 2026, shifts liability onto websites and restricts how they can address VPN usage, potentially reshaping how online services operate both within and beyond the state.

The Electronic Frontier Foundation (EFF), a leading nonprofit organization focused on defending civil liberties in the digital world, outlined how Utah’s Senate Bill 73 (SB 73), signed into law by Governor Spencer Cox on March 19, introduces provisions that go beyond traditional age-verification mandates by explicitly addressing the use of privacy tools such as VPNs.

SB 73, formally titled the “Online Age Verification Amendments,” primarily introduces a 2% tax on revenues from online adult content starting in October 2026. However, the section drawing the most scrutiny is set to take effect earlier and directly targets how users access online content from within Utah. Specifically, the law defines a user’s location based on their physical presence in the state, regardless of whether they attempt to mask it using a VPN, proxy server, or similar technology.

EFF warns that Utah’s approach creates what it describes as a “liability trap” for online platforms. By requiring websites that host a “substantial portion of material harmful to minors” to verify the age of users physically located in Utah, even if they use anonymization tools, the law imposes obligations that may be technically impossible to fulfill with certainty.

SB 73 also prohibits affected platforms from providing instructions or assistance on how users might use VPNs to bypass age verification systems. This restriction extends to any form of encouragement or facilitation, effectively limiting how companies can discuss lawful privacy tools with their users. Legal experts cited in the report suggest this could raise First Amendment concerns, as it restricts the dissemination of factual information about widely used security technologies.

Unlike more aggressive proposals previously considered in states such as Wisconsin, Utah’s law stops short of outright banning VPN usage. Instead, it adopts a more indirect enforcement model, in which websites are expected to act if they become aware that a user is located in Utah and attempting to bypass controls using a VPN. This “don’t ask, don’t tell” framework introduces ambiguity, leaving companies uncertain about the extent of their compliance obligations.

From a technical standpoint, it’s difficult to reliably identify and block all VPN or proxy traffic. VPN providers frequently rotate IP addresses, and no definitive, comprehensive database of this infrastructure exists. As a result, platforms attempting to comply may resort to broad measures such as blocking large ranges of IP addresses or requiring age verification from all users globally, potentially impacting millions of users outside Utah.