Utah has started enforcing the adult website age verification requirements in SB 73, but one piece of the law is not in effect. A federal injunction blocks the separate provision targeting VPN users. The result is a split outcome for the Utah SB 73 VPN age verification debate: age checks are moving forward, while the part aimed at circumvention tools is on hold.

This post breaks down what is and is not being enforced, and what the situation means for people in Utah who use VPNs.

What SB 73 Requires From Adult Sites

SB 73, formally known as the Online Age Verification Amendments, is built around adult website age verification. Under the enforcement now underway, adult sites must verify that visitors are adults before granting access. According to the enrolled text of the bill as described in search results, the law provides a safe harbor for approved age verification methods and refers to users who are 18 years old or older.

This part of the law is the more conventional piece. Age verification mandates for adult content have become common across US states, and Utah's rules now operate in that same space. Operators that serve Utah visitors are expected to put an age check in place rather than relying on a simple click-through confirmation.

The bill drew extra attention because it did not stop at the sites themselves. It also reached into how people connect to them.

Why the VPN Provision Was Blocked

The VPN-related provision attempted to address a familiar workaround. A VPN can make a user appear to be in another location, which can sidestep location-based age checks. According to reporting on the case, SB 73 tried to handle this by requiring adult websites to block VPN users, or to identify the physical location of visitors using them, so that users physically in Utah would still be age verified.

A federal court has now blocked that provision through an injunction. Coverage of the ruling describes the legislation as targeting VPN use by requiring adult platforms to verify the age of users physically located in Utah even if they connect through a VPN. The injunction stops that requirement from taking effect, while leaving the rest of the age verification framework intact.

Note what the law did not do. Commentary on SB 73 points out that it does not ban VPNs outright. The dispute is over whether a state can push websites to treat VPN traffic differently and effectively police circumvention tools.

What the Injunction Means for Utah Residents Now

For day-to-day use, the practical picture is fairly simple:

  • Adult site age checks are live. Utah residents visiting adult websites should expect to encounter age verification.
  • The VPN provision is not enforceable. Because of the injunction, sites are not being required under SB 73 to block VPN users or to determine the physical location behind a VPN connection.
  • VPN use remains legal. Nothing in the current situation makes using a VPN unlawful for Utah residents.

That said, an injunction is not necessarily the final word. Court orders like this can be challenged, narrowed, or revisited as litigation continues, so the current status reflects where the case stands now rather than a permanent outcome.

Where VPNs Fit in the US Age-Verification Fight

The Utah case shows a pattern in age-verification policy. When a state requires checks based on location, people can route around them, and lawmakers then face a choice: accept that gap or try to regulate the workaround. Utah chose to try the second path, and the court has stopped that part for now.

The bigger question is how far states can go in regulating circumvention tools. VPNs are used for many ordinary reasons, including protecting traffic on public Wi-Fi, securing remote work connections, and limiting tracking. A rule that treats VPN traffic as suspect affects all of those uses, not just attempts to avoid an age check. That tension is a central reason this provision has drawn so much scrutiny.

It also connects to how states think about identity more broadly. Age checks require some form of proof, and the design of that proof matters for privacy. Utah has been working on that side of the issue too, as seen in its push for a 10-state coalition around SEDI digital ID privacy, which treats privacy as a design requirement rather than an afterthought.

What This Means For You

If you live in Utah or visit its residents' side of the internet through a VPN, here is the short version:

  • You will likely see age verification prompts on adult sites, whether or not you use a VPN.
  • Using a VPN is not illegal, and the provision aimed at VPN users is currently blocked.
  • Be thoughtful about any age verification service you are asked to use. Check what data it collects, how long it keeps it, and whether it offers privacy-preserving options.
  • Do not assume the legal situation is settled. Injunctions can change as the case develops.

Takeaways and What to Watch

The Utah SB 73 VPN age verification story is really two stories. One is the ordinary rollout of adult site age checks. The other is a court limiting a first-of-its-kind attempt to regulate how VPNs interact with those checks.

To keep up with the issue, follow the litigation for any change in VPN legality or in how the injunction is applied. For a broader look at how Utah approaches identity and privacy design, read our piece on its SEDI digital ID privacy effort, and stay informed about what any age verification process asks you to share.