Utah age verification law has crossed a line that no other US state has dared to cross: it explicitly penalizes websites for failing to verify the age of users who mask their location with a VPN. Senate Bill 73 cleared both chambers of the Utah legislature on March 4, 2026, with enforcement expected to begin in May 2026, making Utah the first state to target VPN users directly in its age verification mandate.
Key Takeaways
- Utah’s Senate Bill 73 targets websites hosting adult content and requires age verification even for VPN users, effective May 2026.
- Websites cannot facilitate or encourage VPN use, including providing instructions on how to bypass age checks.
- Over 20 US states now have age verification laws; Wisconsin scrapped its VPN restrictions after public backlash, unlike Utah.
- NordVPN calls the law a “liability trap” that could “punish all VPN users globally” with unintended consequences.
- Digital rights groups warn the law creates surveillance risks and that VPNs remain easy bypasses for determined users.
Why Utah’s Approach Is Unprecedented
Utah’s law goes further than any previous state mandate. While Louisiana, Arkansas, Texas, Montana, Florida, and other states have enacted age verification requirements, none explicitly restrict VPN use or penalize websites for failing to detect and block geolocation spoofing. The Utah law prohibits websites from facilitating or encouraging VPN use to bypass checks, including providing instructions on how to access content via such services. This creates a novel liability framework: websites must somehow detect and reject traffic from VPN users within Utah, or face penalties.
The law’s vagueness about enforcement mechanisms is precisely what digital rights experts find most troubling. How exactly should a website block a VPN user who is physically in Utah but routing traffic through another state or country? The technology does not exist reliably. VPN providers deliberately make their services difficult to detect and block. This is not a technical problem with a clean solution—it is what one industry observer called “a technical whack-a-mole”.
The History of Failed Age Verification in Utah
Utah has tried this before. In May 2023, the state passed Senate Bill 287, which required age verification for adult websites. The result? Pornhub blocked Utah IP addresses entirely rather than implement age verification. Google searches for “VPN” in Utah spiked on May 3, 2023, the day the law took effect. Users did not comply with age verification—they simply routed around it. The new law assumes this lesson does not apply, or that websites will somehow do better this time.
The irony is sharp: Utah’s prior attempt to restrict adult content access directly caused a surge in VPN adoption, the very behavior the new law aims to prevent. According to Suzanne Bernstein, a law fellow at the Electronic Privacy Information Center, “VPN is an easy way to circumvent age-verification requirements”. Utah’s legislators appear to believe they can legislate around this technical reality. They cannot.
What VPN Providers and Privacy Groups Say
NordVPN has been blunt about the law’s implications. The company calls it a “liability trap” that could “punish lawful users who care about their privacy” globally. The concern is not hypothetical: if websites must detect and reject VPN traffic from Utah, they may over-block and reject all VPN traffic, harming privacy-conscious users everywhere.
Private Internet Access (PIA) echoes this concern, warning that “Utah’s age-verification law shows a worrying trend to further restrict digital freedoms and disregard data privacy across the US”. PIA also highlights the data collection risk: “The introduction of online age verification… means that for those wanting to access adult entertainment, a huge amount of personal, sensitive data will now be collected—data that could be improperly used, accessed, or leaked”.
The Electronic Frontier Foundation (EFF) frames the issue differently but reaches the same conclusion. “VPNs are not foolproof, nor should they be necessary to access legally protected speech,” the EFF stated. The group argues that age verification itself—regardless of VPN targeting—creates surveillance infrastructure that governments and bad actors can abuse.
A National Trend, But Utah Goes Furthest
Utah is not alone in pursuing age verification. Louisiana became the first state to enact such a law in 2023. Since then, Arkansas, Texas, Montana, Florida, South Carolina, Tennessee (2025), Kansas, Alabama, and Oklahoma (2024) have followed. Georgia is expected to implement a similar law in July 2026. But none of these states has explicitly restricted VPN use the way Utah has.
Wisconsin offers a telling counterpoint. The state initially included VPN restrictions in its age verification bill but scrapped them after public backlash. Wisconsin lawmakers recognized that targeting VPN users was politically and technically untenable. Utah’s legislature either did not learn this lesson or chose to ignore it.
The Broader Data Privacy Risk
Beyond the VPN question, age verification laws create a separate problem: they require websites to collect and store sensitive personal data. Aylo, the parent company of Pornhub, stated that “any regulations that require hundreds of thousands of adult sites to collect significant amounts of highly sensitive personal information is putting user safety in jeopardy”. Each breached database of age-verified users becomes a target for identity theft, blackmail, and harassment.
A March 2, 2026 open letter signed by 419 scientists called for a moratorium on mandatory age verification technology, citing its ease of bypass and privacy risks. The letter suggests that age verification is a solution in search of a problem—it does not work, and the attempt to make it work creates worse harms.
What Happens Next
Enforcement of Utah’s law begins in May 2026. Websites will face pressure to implement detection systems that do not reliably exist. Some may block all VPN traffic globally, harming privacy-conscious users worldwide. Others may simply refuse to serve Utah users. A few may attempt to collect and verify age data, creating the surveillance infrastructure that privacy advocates fear most.
The law’s vagueness leaves room for legal challenge. Courts may strike it down as technically impossible to comply with, or as an unconstitutional restriction on speech and privacy. But until then, Utah becomes a test case for how far a state will go to restrict both adult content and the privacy tools people use to protect themselves online.
Will Utah’s age verification law actually stop minors from accessing adult content?
No. The 2023 Pornhub block in Utah led to a spike in VPN searches, not compliance. Users determined to bypass age verification have multiple technical and behavioral workarounds. The law may inconvenience some users but will not meaningfully reduce minor access to adult content.
Can websites actually detect and block VPN users in Utah?
Not reliably. VPN providers design their services to be difficult to detect. Websites would need to guess which traffic is VPN-routed, a task that produces both false positives (blocking legitimate Utah users) and false negatives (missing VPN users). Over-blocking is more likely, which harms privacy-conscious users globally.
How does Utah’s law compare to other states’ age verification laws?
Utah is the first state to explicitly target VPN users and penalize websites for failing to detect geolocation spoofing. Other states like Louisiana, Arkansas, and Texas have age verification mandates but do not restrict VPN use. Wisconsin initially considered VPN restrictions but removed them after backlash. Utah’s approach is the most aggressive and most controversial.
Utah’s age verification law represents a dangerous escalation in state-level internet regulation. It targets a technical problem—VPN use—that cannot be solved without either breaking privacy tools or creating surveillance infrastructure. The law will likely fail to achieve its stated goal of protecting minors, while succeeding at harming privacy-conscious adults and creating new data security risks. As enforcement looms in May 2026, the question is not whether the law will work, but how much damage it will do in the attempt.
Edited by the All Things Geek team.
Source: TechRadar
