Utah's Anti-VPN Law, Which Kicks In This Week, Might Break the Web for Everyone

Key Takeaways

• Utah's SB 73 takes effect May 6, 2026, making it the first US state law in effect to explicitly target VPN use in the context of age-verification mandates.
• The law holds websites liable for verifying the ages of anyone physically in Utah, including VPN users whose true location websites have no way of detecting.
• Because no website can reliably identify a VPN user's real location, the only workable compliance paths are mandating age verification for every visitor globally, blocking all known VPN IP addresses, or geo-blocking Utah entirely.
• The law also bans websites from providing users with VPN information or instructions, raising serious First Amendment concerns.
• Neither outcome stops a determined teenager from routing around it within hours.

When You Can't See the Problem, You Can't Regulate It

Utah's Senate Bill 73, signed by Governor Spencer Cox on March 19, 2026, and taking effect this Wednesday, May 6, is a genuinely new kind of bad idea. Previous age-verification laws at least targeted something websites could theoretically control. SB 73 holds websites legally liable for users whose physical location is, by design, undetectable.

Section 14 of the bill does two things. Anyone physically in Utah is considered to be accessing a website from Utah, regardless of any VPN or proxy masking their location, and commercial entities hosting content harmful to minors are banned from facilitating or encouraging VPN use to bypass age checks, including providing instructions on how VPNs work. Wisconsin tried a harder version of this and dropped it after widespread pushback on constitutional and technical grounds. Utah, apparently unimpressed by that outcome, went ahead anyway.

The structural problem is immediate, and a website receiving a connection request has no reliable way to know whether the person behind that IP address is physically in Utah or sitting in a coffee shop in Amsterdam using a VPN.

Three Exits From an Impossible Room, and None of Them Work

Given that compliance is technically impossible in any straightforward sense, websites are left with three options. The first is to mandate age verification for every visitor globally, because that's the only way to guarantee no Utah-based VPN user ever slips through unverified. The second is to block all known VPN and proxy IP addresses, which the EFF correctly describes as a whack-a-mole that no company can win, given that providers add new IP addresses constantly and no comprehensive blocklist exists. The third is to geo-block Utah entirely, cutting off the whole state's user base to avoid the liability problem altogether.

Layered on top of all three paths is the muzzle clause, with SB 73 also prohibiting websites from providing users with information about VPNs or instructions on how to use them, meaning platforms can't even tell affected users why their access changed.

The people this actually hurts aren't teenagers determined to access adult content, who will transition to private tunnels, residential proxies, or other workarounds within hours. The people it hurts are journalists protecting sources, abuse survivors who rely on VPNs for basic safety, and privacy-conscious adults who simply don't want their browsing habits handed to ad networks.

A Precedent That Will Outlast Utah

The Cato Institute stated that when an internet policy can be avoided by a relatively common technology that often provides significant privacy and security benefits, maybe the policy is the problem. Utah's answer is to attack the technology rather than reconsider the policy, which tells you everything about what's actually driving these laws.

Utah won't be alone for long. The UK Children's Commissioner has already called VPNs a "loophole that needs closing," and France's minister responsible for digital affairs has stated that VPNs are "the next topic on my list" following that country's social media ban for under-15s. The pattern is consistent: mandates fail, VPN usage surges, and governments respond by targeting VPNs rather than accepting that the original mandate was flawed.

I'd ask the lawmakers behind SB 73 to explain, concretely, what a website is supposed to do on Wednesday when a user connects from a Utah IP running through a VPN exit node on the other side of the world. There's no answer that doesn't involve either punishing everyone or achieving nothing, and a law that offers only those two outcomes protects absolutely no one. It does, however, hand every government that comes after it a template for treating privacy infrastructure as a problem to be regulated out of existence, and that's the part that should worry all of us, regardless of where we live.