Starting September 3, Utah becomes the first state to enforce a law that explicitly targets VPN use as part of age verification enforcement, and the industry that needs to comply is saying, on the record, that it doesn’t know how to.
Senate Bill 73, formally the “Online Age Verification Amendments,” was signed by Governor Spencer Cox in March after passing the state Senate 22-2 and the House 66-1, about as close to unanimous as state legislation gets. It requires commercial websites where more than a third of the content qualifies as harmful to minors to implement age verification for Utah users. The verification requirement itself isn’t a unique concept, as Utah’s had some version of that since 2023, but the new law brings location into question. Under SB 73, anyone physically located in Utah counts as a Utah user regardless of what IP address their connection shows. Someone in Salt Lake City routing through a server in Germany is still, legally, a Utah user, and the site they’re visiting is still on the hook for verifying their age. Sites are also barred from publishing instructions on how to use a VPN to get around the age gates. Penalties run up to $2,500 per violation, with additional civil exposure for noncompliant platforms. The law was originally set to launch in May but got paused by a court injunction after Pornhub’s parent company Aylo challenged it; that injunction expires the day before the law takes effect.
The core problem, according to critics across the privacy and civil liberties world, is that reliably detecting VPN traffic at scale is a technical problem nobody’s actually solved. Commercial VPNs, residential proxy networks, rotating IP pools, and privacy-focused browsers all generate traffic that looks functionally identical to ordinary internet use. A blocklist of known VPN IPs is obsolete within days of being compiled, since addresses rotate constantly, and casting a wide enough net to catch VPN traffic reliably would also snag corporate networks, mobile hotspots, and shared carrier connections used by completely ordinary users. The Electronic Frontier Foundation has called the compliance challenge “technical whack-a-mole” and gone further, describing the law as a “liability trap.” Sites face real financial exposure for failing at a task that may not be technically achievable at all, which the EFF warns could push platforms toward blanket VPN blocks or mandatory age verification for every visitor worldwide, Utah resident or not. One VPN provider pushing back publicly against the law has framed it in similar terms: a compliance model built around a capability the industry simply doesn’t have yet.
There’s a First Amendment wrinkle too. By banning affected sites from sharing information about VPN use, the law effectively gags platforms from discussing a legal privacy tool. The EFF calls it a “don’t ask, don’t tell” framework, since sites likely only trigger their verification obligation once they somehow become aware a specific visitor is both in Utah and using a VPN, leaving the broader policing requirement murky at best.
None of this touches ordinary VPN use, though. Using a VPN to secure a connection on airport WiFi, access banking remotely, or keep an internet provider from logging browsing history remains completely legal in Utah. SB 73 targets a narrow interaction between adult sites and Utah-based visitors, not VPN technology generally.
The bigger significance is what happens next, well beyond Utah’s borders. At least 26 other states already have age-verification laws in place or under consideration, and legal analysts are explicitly treating SB 73 as the test case for whether VPN-targeting language can survive judicial scrutiny. If it holds up in court, expect similar provisions to spread fast. If it’s struck down, the entire model resets. Australia’s eSafety Commissioner is watching closely too, weighing whether to require platforms to actively block VPN workarounds after the country’s existing age checks triggered a surge in VPN downloads, while the UK considered and abandoned a similar VPN-blocking approach earlier this year over privacy concerns. The world will be watching to see what happens next.