Utah to Become First US State to Penalize Websites for Helping Users Bypass Age Gates with VPNs

Key facts

• Utah's Senate Bill 73 was signed by Governor Spencer Cox on March 19, 2026.
• The VPN provisions take effect on May 6, 2026.
• The law prohibits commercial entities hosting material harmful to minors from facilitating or encouraging VPN use to bypass age checks.
• Websites are liable for verifying age of any user physically in Utah regardless of apparent virtual location.
• A similar proposal to ban VPNs was defeated in Wisconsin due to constitutional concerns.
• The law also imposes a 2% tax on revenues from online adult content starting in October 2026.
• The Electronic Frontier Foundation (EFF) warns the law creates a 'liability trap' that could force global age verification or VPN blocking.

A New Legal Frontier in Age Verification

On May 6, 2026, Utah will become the first state in the United States to enact legislation that directly targets the use of Virtual Private Networks (VPNs) to circumvent legally mandated age-verification gates. The law, formally known as the Online Age Verification Amendments or Senate Bill 73, was signed by Governor Spencer Cox on March 19, 2026. While the majority of the bill includes a 2% tax on revenues from online adult content set to take effect in October, the VPN-related provisions have drawn immediate concern from digital rights advocates.

Two-Pronged Approach: Location Liability and Speech Restrictions

The new law amends Section 78B-3-1002 of Utah statutes in two key ways. First, it establishes that an individual is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN, proxy server, or other means to disguise their geographic location. Second, commercial entities that host 'a substantial portion of material harmful to minors' are prohibited from facilitating or encouraging the use of a VPN to bypass age checks. This includes providing instructions on how to use a VPN or providing the means to circumvent geofencing.

The Liability Trap and Its Global Consequences

By holding companies liable for verifying the age of anyone physically in Utah even when they use a VPN, the law creates what the Electronic Frontier Foundation (EFF) calls a 'massive liability trap.' If a website cannot reliably detect a VPN user's true location, the legal risk could push the site to either ban all known VPN IP addresses or mandate age verification for every visitor globally. This would subject millions of users worldwide to invasive identity checks or blocks on VPN use, regardless of where they actually live. The EFF had previously raised similar concerns about a Wisconsin bill, which was ultimately defeated after advocates successfully forced the removal of comparable provisions due to constitutional and technical concerns.

First Amendment Concerns and Technical Impossibility

The ban on sharing VPN instructions raises significant First Amendment concerns, as it prevents platforms from providing basic, truthful information about a lawful privacy tool to their users. Unlike previous drafts in other states, SB 73 does not explicitly ban VPN use; instead, it discourages it through liability and speech restrictions. However, the technical feasibility of compliance is questionable. Blocking all known VPN and proxy IP addresses is a 'technical whack-a-mole,' as providers constantly add new IP addresses and no comprehensive blocklist exists. The EFF argues that complying with Utah's requirements would require impossible technical feats.

Inevitable Workarounds and Collateral Damage

If Utah successfully hampers commercial VPN providers, motivated users will likely transition to non-commercial proxies, private tunnels through cloud services like AWS, or residential proxies that are virtually indistinguishable from standard home traffic. These workarounds could emerge within hours of the law taking effect. The collateral damage will fall on businesses, journalists, and survivors of abuse who rely on commercial VPNs for essential data security. The law will not stop a tech-savvy teenager, but it will impact the privacy of every regular Utah resident who wants to keep their data out of the hands of brokers or malicious actors.

A Precedent for Other States and Legal Challenges Ahead

Utah is the farthest state along a path that seems inevitable for all states with age-gate laws: the internet's amorphous nature means that enforcing large-scale bans practically requires broad crackdowns on privacy and free expression. Thus far, states appear reluctant to cross the threshold into total VPN bans, as seen in Wisconsin. However, given that Utah's law largely has the same impact even for those outside the state, lawsuits and legal challenges are expected in the weeks and months ahead. The EFF has called for help to stop similar VPN bills across the country.

The bottom line

• Utah's SB 73 takes effect May 6, 2026, making it the first US state to penalize websites for aiding VPN use to bypass age verification.
• The law holds websites liable for age-verifying anyone physically in Utah, even if they use a VPN to mask their location.
• Commercial sites are banned from sharing VPN instructions or providing means to circumvent geofencing.
• The law raises First Amendment concerns and may be technically impossible to comply with, as VPN IP addresses are constantly changing.
• Similar provisions were removed from a Wisconsin bill due to constitutional and technical concerns, but Utah's law proceeds.
• Legal challenges are anticipated, and the law could set a precedent for other states considering age-verification mandates.