Utah's SB 73 VPN Law Takes Effect, Providers Push Back

Utah has become the first U.S. state to pass a law that directly targets VPN use as part of its age verification rules, and the fallout is already underway. Senate Bill 73, formally known as the Online Age Verification Amendments, has officially taken effect, but ongoing litigation and resistance from major VPN providers mean the law's real-world impact is still very much up in the air.

The Utah VPN age verification law was originally slated to take effect on May 6, 2026, as detailed in our earlier coverage of Utah's SB 73 VPN age verification law. Legal challenges pushed back full enforcement, and the law is now officially on the books following months of court battles that have delayed its strictest provisions.

What SB 73 Actually Requires

At its core, SB 73 is designed to force adult content websites to verify the age of their users. What makes it unusual, and what has drawn national attention, is that the law does not stop at requiring age checks. It also holds websites liable if users manage to bypass those checks by using a VPN to mask their location or identity.

In practice, this means a website could face penalties, reportedly up to $2,500 per violation, even if a user in Utah successfully uses a VPN to appear as though they are browsing from another state or country. That shifts the compliance burden onto site operators to detect and block VPN traffic altogether, rather than simply verifying age through conventional means.

This approach is notably different from age verification laws in other states, which typically focus on the verification process itself rather than the tools people use to access the internet. By explicitly targeting VPN use, Utah has opened a new front in the debate over online privacy, identity verification, and free access to the internet.

Why VPN Providers Are Refusing to Comply

Major VPN providers have pushed back hard against the law, and so far, none appear willing to change how their services operate to accommodate it. VPNs work by routing traffic through servers in other locations, which is precisely the functionality SB 73 attempts to penalize when it is used to get around age checks. Asking providers to detect and restrict this behavior for users physically located in Utah runs counter to how the technology fundamentally works and would require providers to track and flag user locations in ways that conflict with their privacy commitments.

This standoff highlights a broader tension: lawmakers want a mechanism to enforce state-specific rules on a borderless internet, while VPN providers argue that singling out their tools undermines the basic privacy protections their users rely on. So far, the providers have held their ground rather than build in workarounds that would weaken their products for everyone, not just users in Utah.

Litigation Leaves the Law's Future Uncertain

Despite officially taking effect, SB 73 remains tangled in legal challenges that have kept its strictest enforcement mechanisms paused. This means that while the law technically exists, how aggressively it will be enforced, and whether courts will ultimately uphold its VPN-specific provisions, is still unresolved. The outcome of this litigation will likely set an important precedent for other states considering similar measures, making Utah a test case that other lawmakers and privacy advocates are watching closely.

What This Means For You

If you live in Utah or regularly access websites that fall under this law, it's worth understanding that the legal landscape is shifting rather than settled. The Utah VPN age verification law does not make VPNs illegal, and there is no indication that individual users face penalties for using one. The liability, at least as written, falls on websites that fail to block VPN-based workarounds. Still, the uncertainty created by ongoing court battles means enforcement could look very different in the coming months depending on how the litigation resolves.

For now, VPN providers are not altering their services in response to the law, so functionality for Utah users remains unchanged. That could shift if courts uphold the law's provisions and providers face pressure to respond.

Key Takeaways

Utah's SB 73 marks a significant moment in the ongoing conversation about privacy, age verification, and internet regulation, but its future is far from settled. Readers should keep an eye on how the litigation unfolds, since it will likely influence how other states approach similar legislation. In the meantime, using a reputable VPN remains a legal and effective way to protect your privacy online, and staying informed about the outcome of this case is the best way to anticipate any changes that might eventually affect access to services in Utah.