Utah's SB 73 VPN Age Verification Law Takes Effect May 2026

Utah's Utah VPN age verification law, officially known as the Online Age Verification Amendments (SB 73), took effect on May 6, 2026, making Utah the first U.S. state to directly target the use of VPNs in the context of online age verification. The law places new obligations on websites hosting substantial amounts of adult content, and its implications stretch well beyond Utah's borders.

Critics, including the Electronic Frontier Foundation, have raised serious concerns that the law is technically unenforceable as written and could trigger a cascade of unintended consequences for internet users worldwide. Here is what you need to know.

What SB 73 Actually Requires of Websites and VPN Users

At its core, SB 73 requires any website that hosts substantial adult content to verify the age of users who are physically located in Utah before granting access. The critical word is "physically." The law does not exempt users who connect through a VPN to mask their real geographic location.

In practical terms, this means websites are expected to determine a user's actual physical location even if that user's IP address suggests they are connecting from somewhere outside Utah. The law places the compliance burden squarely on website operators, not on individual users, but it creates liability exposure that most platforms will want to avoid.

For ordinary VPN users, the implication is direct: simply connecting through a server outside Utah does not, under this law, relieve the website of its duty to verify your age if you are physically sitting in Utah.

Why Enforcing Location Checks Against VPN Traffic Is Nearly Impossible

This is where SB 73 runs into a fundamental technical wall. When a user connects through a VPN, their true IP address is replaced by the VPN server's IP address. Websites receive no reliable signal about where the user is physically located. There is no standardized technical mechanism that allows a website to pierce a VPN connection and confirm a user's real geography.

Some have suggested that device-level signals, such as GPS data or time zone settings, could theoretically be used. But accessing that data requires explicit user permission and is easily manipulated. The result is that websites cannot realistically comply with SB 73's mandate without either demanding invasive personal data from every visitor or making broad assumptions that expose them to legal risk.

As our earlier reporting on Utah's SB 73 and its civil liberties implications detailed, the bill was criticized well before it passed for creating compliance burdens that are technically incoherent. The law essentially asks websites to solve a problem that current internet infrastructure cannot reliably solve.

The Risk of Global VPN Blocks and Mass Invasive Verification

Faced with this impossible compliance puzzle, adult content platforms are likely to choose from a short list of blunt workarounds. The two most probable responses are:

Blocking all VPN traffic globally. If a website cannot distinguish a Utah resident using a VPN from anyone else using a VPN, the simplest path to limiting liability is to block all recognized VPN IP addresses entirely. This would affect every VPN user worldwide who visits that platform, not just those in Utah.

Imposing invasive age verification on all visitors. Alternatively, platforms may decide to require age verification for every user regardless of location, treating the Utah compliance requirement as a reason to implement universal identity checks. This could mean uploading government-issued ID or submitting to biometric checks just to access legal content.

Both outcomes are disproportionate responses to a state-level law, but they reflect the reality that websites cannot surgically enforce location-specific rules when VPNs are involved. Millions of users in other states and countries would bear the cost of Utah's policy choice.

What This Law Signals for VPN Regulation Across Other States

Utah is not acting in isolation. Several other states have passed or are considering age verification laws for adult content, and SB 73 is notable for being the first to explicitly grapple with VPN circumvention. Its passage signals that legislators in other states may follow suit, incorporating anti-VPN language into their own bills.

This creates a fragmented regulatory environment where websites must navigate different rules in different states, each potentially requiring different technical responses. For VPN users, the concern is that what starts as a niche legal question in Utah could become a template that justifies broader VPN restrictions tied to age verification, content filtering, or other policy goals.

The pattern matters because the justification used here, that VPNs obstruct legitimate regulatory enforcement, can be applied to almost any content regulation. Once that logic is accepted in one context, it becomes easier to expand.

What This Means For You

If you use a VPN for privacy, security, or general browsing, SB 73 does not directly criminalize your VPN use. The law targets website operators, not individual users. However, the downstream effects could shrink your access to legal content and push platforms toward more invasive identity verification systems that affect everyone.

Here is what you can do right now:

  • Stay informed about platform responses. Watch for announcements from major content platforms about changes to their access policies, particularly around VPN blocking or new identity verification requirements.
  • Understand your rights. Age verification laws that require submission of government ID or biometric data carry their own privacy risks. Knowing what data a platform collects and how it stores it matters before you hand anything over.
  • Monitor similar legislation in your state. Bills modeled on SB 73 are being considered in other states, and tracking them early gives you time to engage with your representatives before laws pass.
  • Read the detailed civil liberties analysis. The full breakdown of SB 73's implications for digital rights, including its potential to normalize VPN restrictions, is covered in depth in our earlier piece on Utah's SB 73 as a threat to VPNs and digital rights.

Utah's SB 73 is now law, but its full impact depends on how platforms respond and whether courts ultimately uphold it. The coming months will reveal whether websites comply, fight back, or simply block VPN users wholesale. Either way, this is a law worth watching closely.