Utah Starts Enforcing Age Checks, but Its VPN Crackdown Remains Blocked

Utah is moving ahead with mandatory age checks for adult websites, even though a federal judge has blocked its attempt to make platforms track users hiding their locations with VPNs.

According to TechRadar's November 4 report, the state's Department of Commerce confirmed that enforcement began on November 2. Websites covered by the law must now verify that visitors are at least 18 or risk financial penalties.

The distinction matters. Utah can enforce age verification, but it still can't require websites to determine where every visitor is physically located, regardless of whether they're using a VPN.

What Utah Is Enforcing Now

Senate Bill 73, the Online Age Verification Amendments, requires commercial websites publishing substantial amounts of material considered harmful to minors to implement reasonable age verification methods.

The state's Division of Consumer Protection can investigate noncompliant platforms and impose fines of up to $2,500 per violation. A separate 2% excise tax on covered websites also took effect on October 1.

In its official announcement, the Department of Commerce emphasized that the court ruling does not prevent enforcement of the core age verification requirement.

For users, that means covered websites may require age verification before granting access. Depending on the method used, this could involve identity documents, facial age estimation, or third-party verification services.

Utah officials say the law requires verification of age, not identity, and that information used for verification must be deleted immediately. But the broader privacy question remains: how much personal information should someone have to provide to access legal content?

Why the VPN Restrictions Are Still Blocked

The controversial part of SB 73 went further than age verification.

It required websites to account for users physically located in Utah even when they concealed their location through VPNs or similar technologies.

In September, U.S. District Judge David Barlow granted a preliminary injunction against that provision after a legal challenge from Aylo, Pornhub's parent company.

As we previously reported, the court found that the requirement would effectively make websites responsible for determining something they cannot reliably know: the actual physical location of every visitor.

A VPN routes internet traffic through another server, replacing the user's visible IP address with the server's address. Websites generally cannot determine a user's true location from that connection alone.

Requiring platforms to identify VPN users' actual locations would therefore create an impossible compliance problem. Websites might respond by blocking VPN connections altogether, including those used for legitimate privacy and security purposes.

The injunction remains preliminary, so the legal dispute is not over. But for now, Utah cannot enforce that specific requirement.

Protecting Children Shouldn't Require Tracking Everyone

Utah lawmakers argue that age verification is necessary to prevent minors from accessing explicit content. That goal is understandable, and protecting children online is a legitimate concern.

The problem is how those protections are implemented.

Age verification can introduce new privacy risks when users must share sensitive information with websites or third-party verification providers. Even when systems promise not to retain identifying data, their security and transparency still matter.

VPN restrictions add another problem. People use VPNs for far more than accessing restricted websites. They help protect internet traffic on public Wi-Fi, reduce IP-based tracking, and make browsing more private.

Treating those protections as suspicious creates a dangerous precedent.

Utah's court ruling shows why technical realities matter when governments regulate the internet. A law designed to protect minors shouldn't force websites to block legitimate security tools or attempt surveillance they cannot reliably perform.

What Happens Next?

Utah's age verification requirements are now being enforced, and state investigators have begun preparing compliance audits. The VPN-related provisions remain on hold while litigation continues.

The outcome could influence how other US states approach age verification, particularly when their proposals involve identifying users who rely on VPNs or other privacy tools.

For now, the distinction is clear: Utah can require covered websites to verify users' ages, but it cannot enforce the blocked provision demanding reliable location detection through VPNs.

The bigger question is whether future online safety laws can protect children without turning ordinary internet privacy into something that needs to be justified.