Utah’s age verification law represents a historic shift in how states regulate internet access for minors. Senate Bill 73, signed by Governor Spencer Cox on March 19, 2026, makes Utah the first U.S. state to explicitly target VPN use in age verification enforcement, taking effect May 6, 2026.
Key Takeaways
- Utah becomes the first state to target VPNs in age verification law, effective May 6, 2026.
- Websites remain liable for minors accessing harmful content even if they use VPNs to mask location.
- The law prohibits websites from providing VPN instructions or encouraging circumvention tools.
- Digital rights groups warn the law creates an unresolvable compliance paradox for websites.
- Constitutional challenges are already underway from free speech advocates.
How Utah’s age verification law defines location
The Utah age verification law applies to commercial entities hosting substantial amounts of material harmful to minors, such as adult content websites. What makes this law unprecedented is how it defines user location. Under SB 73, an individual is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN, proxy server, or other means to disguise their geographic location. This definition creates an immediate problem: websites cannot reliably verify physical location using standard internet tools, yet they face liability if they fail to do so.
The Electronic Frontier Foundation warns that by holding companies liable for verifying the age of anyone physically in Utah, even those using a VPN, the law creates a massive liability trap. A minor physically present in Utah could access restricted content by using a VPN while claiming to be elsewhere, and the website would still bear legal responsibility for the access. This reverses the typical burden: rather than placing responsibility on the user or parent to prevent access, the law places it entirely on the website operator, who has no reliable technical means to comply.
What websites cannot do under the law
SB 73 explicitly prohibits covered websites from facilitating or encouraging VPN use to bypass age verification checks. This means websites cannot provide VPN instructions, recommend VPN services, or offer any guidance on circumventing the age verification system. Critics argue this creates an impossible situation. NordVPN stated the law will simply punish lawful users who care about their privacy globally, while doing little to stop determined minors. The prohibition extends to indirect encouragement, making even neutral information about privacy tools potentially problematic for covered sites.
The law also applies to any means of disguising geographic location, not just VPNs. Proxies, location spoofing tools, and similar technologies all fall under the same restrictions. This broad language suggests lawmakers intended to close every possible technical loophole, but in doing so, they have created what digital rights experts describe as a technical whack-a-mole scenario. As soon as one circumvention method is blocked, another emerges, yet websites remain liable regardless of their enforcement efforts.
The broader context of Utah’s minor protection laws
Utah’s age verification law does not exist in isolation. The state previously passed SB 287 in May 2023, which requires age verification for adult content websites with no data retention after verification. SB 152 (2023) regulates social media age checks and parental consent. Additionally, SB 142, the App Store Accountability Act, takes effect on the same day as SB 73—May 6, 2026—and requires app stores to verify ages and obtain parental consent for minors, though it contains no VPN-targeting provisions. Together, these laws represent an aggressive state-level push to restrict minor access to age-inappropriate content across platforms.
This legislative trend contrasts sharply with how other states have approached similar issues. Wisconsin considered comparable VPN-targeting language but removed it due to constitutional and technical concerns. Utah’s decision to move forward despite these objections signals a willingness to test the boundaries of what states can legally require from websites and technology platforms.
Constitutional challenges and legal uncertainty
The Free Speech Coalition has already challenged SB 73 on First Amendment and privacy grounds. Critics argue that prohibiting websites from discussing VPN use violates free speech protections, while the law’s liability structure raises due process concerns. The outcome of these challenges remains uncertain, but they highlight a fundamental tension: can a state legally hold websites responsible for verifying the physical location of users when no reliable technical method exists to do so?
The Electronic Frontier Foundation has been particularly vocal, noting that Utah will become the first state in the nation to explicitly target the use of VPNs to avoid legally mandated age-verification gates. This distinction matters because it goes beyond requiring age verification itself—it criminalizes the tools and information users rely on for privacy. Legal scholars and digital rights organizations view this as a dangerous precedent that could encourage other states to follow suit, potentially fragmenting the internet into dozens of state-specific compliance regimes.
What this means for websites and users
For websites, SB 73 creates an unresolvable compliance paradox. They cannot reliably detect physical location, yet they face damages if a minor in Utah accesses restricted content. Some websites may respond by implementing blanket age gates that apply globally, effectively punishing all users for a law that applies only in one state. Others might block Utah traffic entirely, though this would raise questions about the law’s practical enforceability. Neither solution is ideal, and both represent significant changes to how the internet functions.
For users, the implications are equally troubling. Privacy-conscious individuals—journalists, dissidents, abuse survivors, and ordinary people concerned about surveillance—rely on VPNs and similar tools for legitimate reasons. A law that penalizes websites for even mentioning these tools effectively discourages their use and erodes privacy protections that have nothing to do with age verification. The law treats privacy itself as a threat rather than a right.
Why this matters right now
The May 6, 2026 effective date is approaching rapidly. Websites must decide how to respond, and the uncertainty surrounding constitutional challenges means they face potential liability regardless of their compliance approach. The law also signals a broader trend: states are increasingly willing to regulate internet architecture directly, imposing requirements that conflict with how the internet actually works. If SB 73 survives legal challenges, expect similar laws in other states, fragmenting online privacy and access rules across the country.
Will other states follow Utah’s approach?
The constitutional challenges underway will likely determine whether other states can pass similar laws. If courts uphold SB 73, expect a wave of copycat legislation. If courts strike it down, states will need to find alternative approaches to age verification that do not target VPN use directly. Either way, Utah has positioned itself as a testing ground for aggressive state-level internet regulation.
How can websites comply with Utah’s age verification law?
Compliance options are limited and all carry significant trade-offs. Websites can implement age verification systems that do not rely on location detection, but these typically require identity verification or credit card checks—methods that raise their own privacy concerns. Alternatively, websites might implement geofencing that attempts to detect Utah users, though this is unreliable and can be circumvented. The most practical approach for many sites may be to implement global age gates, but this extends Utah’s law far beyond the state’s borders and affects users worldwide.
What should privacy-conscious users know?
The law does not directly criminalize VPN use by individuals—it targets websites that facilitate or encourage VPN use. However, the chilling effect is real. Users concerned about privacy should understand that websites operating under SB 73 may become less transparent about privacy tools and may implement more aggressive tracking to verify age and location. This represents a trade-off between age verification and privacy that many users did not choose and do not support.
Utah’s age verification law represents a pivotal moment in how states regulate the internet. By explicitly targeting VPNs and placing liability on websites for verifying physical location, the law creates a technical impossibility dressed up as a legal requirement. Whether courts allow it to stand or strike it down, the attempt itself signals that the era of light-touch internet regulation is over. States are now willing to impose requirements that conflict with basic internet architecture, and the consequences for privacy, free speech, and global internet functionality could be profound.
This article was written with AI assistance and editorially reviewed.
Source: Tom's Guide
