Utah's Senate Bill 73: The First US Law to Target VPN Use

Starting May 6, 2026, Utah will enforce what is arguably the most aggressive online age-verification law in the United States. Senate Bill 73, officially titled the 'Online Age Verification Amendments,' does something no other state has attempted: it specifically targets the use of virtual private networks as a tool for bypassing age-verification requirements. The implications stretch well beyond Utah's borders, raising serious questions about privacy, free speech, and the future of internet regulation across the country.

What the Law Actually Requires

At its core, SB 73 holds companies legally liable for verifying the age of any user who is physically located in Utah, regardless of whether that user is connected through a VPN. This is a significant technical and legal challenge. Unlike simply requiring age gates on websites, the law effectively asks companies to pierce through VPN connections to determine a user's real-world location.

But the law goes further. It also prohibits websites from providing instructions on how to use a VPN to circumvent age-verification restrictions. In practice, this means that a privacy-focused website, a news outlet, or even a technology education platform could be held liable for publishing information about how VPNs work if that information could be interpreted as helping someone bypass Utah's age gates.

This prohibition on speech is where legal experts and civil liberties organizations have raised the loudest alarms. The First Amendment protects the right to publish and receive information, and banning the dissemination of factual, educational content about legal software tools sits on very uncertain constitutional ground.

First Amendment and Privacy Concerns

The Electronic Frontier Foundation and other digital rights advocates have pointed out that the law creates a collision between state-level content regulation and foundational free speech protections. Telling a website it cannot explain how a VPN works is not simply a technical restriction; it is a restriction on information. Courts have historically been skeptical of laws that impose prior restraints or blanket prohibitions on truthful, non-commercial speech.

There is also a significant privacy tension baked into the law's premise. Robust age verification typically requires users to submit sensitive personal data, such as government-issued ID or biometric information. Privacy advocates have long argued that mandatory age verification systems create honeypots of sensitive data that are attractive targets for breaches and misuse. Utah's law does not establish clear standards for how that data must be protected once collected, leaving consumers exposed.

For VPN users specifically, the law signals a shift in how states view these tools. VPNs have long been considered legitimate privacy and security software, used by journalists, activists, remote workers, and ordinary people who simply want to protect their data. Framing VPN use as a form of legal evasion, rather than a privacy right, sets a precedent that other states may find tempting to follow.

What This Means For You

If you live in Utah, or operate a website or online service with Utah-based users, the May 6, 2026 effective date is a hard deadline that demands attention.

For individual users, using a VPN to access content in Utah after this law takes effect could expose you to scrutiny, though enforcement against individual users is less clear than enforcement against companies. The law's primary compliance burden falls on website operators and platforms.

For website operators and online businesses, the law creates an obligation to implement age-verification systems capable of detecting physical location even when users mask their IP address. This is technically complex and, for smaller operators, potentially cost-prohibitive. Companies should consult legal counsel familiar with Utah's specific statutory language to understand their exposure.

For anyone who publishes educational content about VPNs, including technology blogs, privacy advocacy organizations, and security researchers, the prohibition on providing bypass instructions warrants careful legal review. The line between general VPN education and actionable bypass instructions is not clearly drawn in the law, and that ambiguity creates risk.

Actionable Takeaways

  • If you operate a website with Utah users, begin assessing your age-verification infrastructure now. May 6, 2026 leaves limited time to implement compliant systems.
  • If you publish content about VPNs or online privacy, review that content with legal counsel to assess whether any of it could be characterized as bypass instructions under SB 73's language.
  • If you are a Utah resident, understand that this law places compliance obligations primarily on companies, but stay informed about how enforcement develops in the months following the effective date.
  • Follow legal challenges closely. Given the First Amendment questions at stake, litigation challenging SB 73 is a realistic possibility. Court rulings could significantly alter how the law is applied or whether it survives at all.

Utah's SB 73 is the first law of its kind in the US, but it likely will not be the last. How courts, companies, and advocacy groups respond to this legislation will shape the trajectory of age-verification policy nationwide. Staying informed is the most important step any user or operator can take right now.