On March 19, 2026, Utah Governor Spencer Cox signed Senate Bill 73, making Utah the first state in the U.S. to enforce a law that targets VPNs for age verification. This legislation aims to regulate access to adult websites by requiring companies to verify users’ ages, even if they are using a Virtual Private Network (VPN) to mask their identities.
The law will take effect on May 6, 2026, and it mandates that companies must ensure compliance with age verification requirements. If they fail to do so, they risk facing legal liabilities, creating what experts are calling a “liability trap” for websites unable to reliably detect VPN users’ locations. This is particularly concerning for millions of users who rely on VPNs for digital privacy.
As other states have implemented age-verification mandates, Utah has witnessed a surge in VPN usage among its residents seeking privacy. The Electronic Frontier Foundation warns that this new law could lead to invasive identity checks for many users. They stated, “This would subject millions of users to invasive identity checks or blocks to their VPN use, regardless of where they actually live.” Such measures raise alarms about the erosion of digital privacy rights.
The law does not explicitly ban VPN usage but effectively discourages it through potential liabilities. Companies providing adult content will also face restrictions: they cannot give instructions on how to bypass age checks using VPNs. This raises serious questions about free speech and the ability of individuals to control their online identities.
NordVPN expressed concern over the technical challenges this law presents. They commented, “Blocking all known VPN and proxy IPs is a technical whack-a-mole that likely no company can win,” highlighting the impracticality of enforcing such regulations without infringing on user privacy.
This legislation has sparked significant debate around First Amendment rights. Critics argue that targeting VPNs undermines the tools that many individuals use to protect their online activities and free expression. As more states consider similar laws, Utah’s approach may set a precedent for how governments regulate online content and privacy.
The effectiveness of this law in enforcing age verification remains uncertain. Officials have not clarified how companies can comply without infringing on user privacy or violating their rights. The unfolding situation in Utah could very well influence future legislative efforts across the country regarding digital privacy and online content regulation.
