Utah's VPN-Targeting Age Verification Law Is Live

Key Takeaways

• Utah's Senate Bill 73, the first law in the US to explicitly target VPN use in the context of age verification, takes effect today, September 3rd, 2026, after being delayed from its original May start date by a court injunction.
• The law holds adult websites liable for verifying the age of anyone physically located in Utah, regardless of whether they're using a VPN. It also prohibits platforms from sharing information about how to use a VPN to bypass age checks.
• The EFF has flagged the VPN instruction ban as a First Amendment violation; platforms are now barred from providing truthful information about a legal privacy tool.

As of today, September 3rd, 2026, Utah is the first state in the US to have a law that explicitly targets VPN use in the context of age verification. 

Senate Bill 73, formally titled the Online Age Verification Amendments, was signed by Governor Spencer Cox in March, blocked temporarily by a court injunction after Aylo (Pornhub's parent company) challenged it, and is now in effect. 

According to reporting by Gizmodo and the EFF's analysis, the law does two distinct things that set it apart from every other age verification law in the country.

First: it holds websites liable for verifying the age of anyone physically located in Utah, regardless of what IP address they present. A Utah resident connecting through a VPN server in Germany is still, in the eyes of this law, a Utah user. The website they visit remains responsible for verifying their age. 

This creates what the EFF describes as a "liability trap" — platforms face real financial penalties for failing at a technical task that no one currently knows how to perform reliably. Detecting whether any given visitor is using a VPN at scale, with sufficient accuracy to meet a legal compliance standard, isn’t a solved problem.

Second: platforms covered by the law are now prohibited from sharing information about how to use a VPN to bypass age checks. That includes instructions, guidance, or any other facilitation of VPN-based circumvention. 

The EFF has flagged this as a First Amendment violation — a state law prohibiting platforms from providing truthful information about a legal tool.

Why This Law Can't Function as Written

The EFF's characterization of the VPN detection requirement as "technical whack-a-mole" is accurate. Commercial VPN providers, residential proxy networks, rotating IP pools, and privacy-focused browsers all present connections that are, from a website's perspective, indistinguishable from ordinary traffic. 

No comprehensive blocklist exists. Providers add new IP addresses constantly. Blocking everything that resembles a VPN would sweep up legitimate users on corporate networks, mobile hotspots, and shared infrastructure that presents similarly.

The law's structure means platforms face two bad options: attempt VPN detection and fail, incurring liability every time a Utah user slips through; or apply age verification globally to every visitor, imposing identity checks on millions of people who have nothing to do with Utah. 

Neither outcome serves the law's stated purpose. Both create significant collateral damage.

The EFF's assessment is direct: "These provisions won't stop a tech-savvy teenager, but they certainly will impact the privacy of every regular Utah resident who just wants to keep their data out of the hands of brokers or malicious actors." 

When age verification mandates don't work as designed, the costs land on ordinary users, not on the people the laws were written to protect.

It's also worth being clear about what SB 73 does not do. It is not a VPN ban. Using a VPN in Utah for any of the reasons VPNs exist — privacy on public networks, secure remote work, preventing ISP tracking, accessing geo-restricted content — remains completely legal. 

The law targets a specific interaction: adult websites subject to Utah's age verification rules and their handling of visitors who happen to be in Utah. For everyone using a VPN for ordinary privacy and security purposes, today changes nothing.

What Happens Next

Utah has been the age verification testing ground for the US since 2023, when it became the first state to require adult sites to verify user ages. That law produced a predictable surge in VPN usage among Utah residents routing traffic through servers elsewhere. 

SB 73 is the legislative response to that workaround, and its fate in court will shape what happens in every other state considering similar provisions.

At least 26 states have age verification laws in effect or under active consideration. Legal analysts and civil liberties organizations have been explicit: SB 73 is a test case for whether VPN-targeting provisions can survive judicial scrutiny. If they do, similar language will appear in other state legislatures. If a court strikes them down, the model changes for everyone.

We've tracked age verification legislation across this series from its legislative origins through court challenges and constitutional rulings — Nebraska's law blocked on First Amendment grounds, France's ban struck down as disproportionate, the KIDS Act and SCREEN Act advancing in the US Senate. SB 73 is the next chapter. 

It's the first law that stops trying to work around VPNs and instead makes VPN use itself part of the liability framework. Today we find out what happens when that approach meets a legal system and an internet that were both built to route around exactly this kind of restriction.