Utah's Age Verification Law Goes Further Than Most

Most age verification laws focus on confirming a user's age before granting access to certain online content. Utah's latest amendments go a significant step further. The state's updated law takes direct aim at VPNs, specifically targeting their ability to mask a user's location and potentially circumvent geographic enforcement of age checks. The Electronic Frontier Foundation (EFF) has raised the alarm, warning that these provisions don't just regulate access to content but actively suppress discussion of legal privacy tools.

The law, set to take effect in Utah, creates what the EFF describes as a "don't ask, don't tell" enforcement mechanism. Websites subject to the law are effectively discouraged from informing users that VPNs exist or that they can be used to protect privacy. That chilling effect on speech, the EFF argues, crosses a constitutional line.

The First Amendment Problem

At the heart of the EFF's concern is a straightforward but serious legal question: can a state government prevent websites from sharing truthful information about lawful tools?

VPNs are legal to use in the United States. They are widely recommended by cybersecurity professionals, privacy advocates, journalists, and even government agencies for protecting sensitive communications. A law that discourages or prohibits websites from mentioning VPNs as a privacy option doesn't just restrict behavior. It restricts speech about entirely lawful behavior.

The EFF argues this creates significant First Amendment concerns. When governments compel silence around legal topics, particularly in ways designed to make it harder for people to exercise their rights, courts have historically been skeptical. Whether Utah's law survives legal scrutiny on those grounds remains to be seen, but the structure of the enforcement mechanism is already drawing serious scrutiny.

The "don't ask, don't tell" framing is deliberate. Rather than explicitly banning VPN use outright (which would face even steeper legal challenges), the law creates an environment where websites are incentivized to stay quiet about VPNs to avoid regulatory liability. The practical effect is similar: users are left less informed about tools they have every right to use.

Why This Could Spread Beyond Utah

Utah has frequently been an early mover on legislation regulating minors' online activity. Its laws often attract attention from other state legislatures looking for ready-made templates. That makes this particular set of amendments worth watching carefully, even for people who don't live in Utah.

If Utah's VPN-targeting provisions survive legal challenges and produce the enforcement outcomes the legislature wants, other states could adopt similar language. The result could be a patchwork of state laws that collectively make it harder for websites operating nationally to discuss privacy tools openly with their users.

For privacy advocates, this represents a notable escalation. Previous age verification debates centered on the tradeoffs between child protection and adult privacy. This law introduces a third dimension: the state's ability to regulate not just what content people access, but what information websites can share about protecting themselves online.

The precedent-setting potential here is significant. A legal framework that treats VPN information as something to be suppressed, rather than a neutral topic of public interest, could be applied in other contexts. Legislators in states with different motivations could use similar mechanisms to discourage discussion of privacy tools for reasons that have nothing to do with age verification.

What This Means For You

If you live in Utah, this law directly affects what information websites may be willing to share with you about online privacy. Even if you don't, the broader trajectory matters.

Here are the key takeaways to keep in mind:

  • VPNs remain legal. No U.S. law currently prohibits individuals from using a VPN, and this Utah law does not change that. What it restricts is website speech about VPNs, not personal use.
  • Chilling effects are real. When websites face regulatory risk for mentioning a topic, they often go silent on it, even if the law doesn't explicitly require silence. Users can end up less informed without any formal prohibition ever being issued.
  • Watch for similar bills in other states. Advocacy groups like the EFF track state legislation closely. Following their updates is one of the most practical ways to stay ahead of laws that could affect your privacy rights.
  • Legal challenges are underway. The EFF and similar organizations frequently bring First Amendment challenges to laws like this. The outcome of any litigation in Utah could shape how far states can go in suppressing privacy-related speech.

The Utah law is a reminder that the legal environment around digital privacy tools is not static. Laws targeting VPNs indirectly, through speech restrictions rather than outright bans, represent a newer and more legally complex strategy. Staying informed is the most important thing anyone concerned about digital privacy can do right now.