Overview
For years, a predictable pattern has emerged worldwide: when governments pass strict age-verification mandates, citizens respond by turning to Virtual Private Networks (VPNs) to protect their privacy. This cycle has played out in states like Florida, Missouri, Texas, and Utah, as well as countries such as the United Kingdom, Australia, and Indonesia. Instead of recognizing that these measures are unpopular, Utah lawmakers have decided to target the VPNs themselves.
On May 6, 2026, Utah will become the first state in the U.S.—according to the Electronic Frontier Foundation (EFF)—to specifically restrict VPN use when it comes to bypassing legally required age-verification gates. While similar efforts in Wisconsin were abandoned after constitutional and technical concerns were raised, Utah is moving forward with legislation that could severely undermine digital privacy rights.
The New Law: SB 73
Formally known as the “Online Age Verification Amendments,” Senate Bill 73 (SB 73) was signed by Governor Spencer Cox on March 19, 2026. While much of the bill focuses on a 2% tax on revenue from online adult content (effective October 2026), a key provision regulating VPN access goes into effect on May 6, 2026—just days from now.
What the Bill Does
The law addresses VPN use in Section 14, which amends Section 78B-3-1002 of Utah’s existing statutes. Two primary changes stand out:
- Physical location trumps digital disguise: Under the law, an individual is considered to be accessing a website from Utah if they are physically located there—regardless of whether they use a VPN, proxy server, or other means to hide their geographic location.
- Ban on sharing VPN instructions: Commercial entities that host “a substantial portion of material harmful to minors” are prohibited from facilitating or encouraging the use of a VPN to bypass age checks. This includes providing instructions on how to use a VPN or offering tools to circumvent geofencing.
How VPNs Are Targeted
Instead of outright banning VPNs—like some earlier proposals—SB 73 adopts a more indirect approach. It places the burden on websites to verify the age of anyone physically present in Utah, even those using VPNs. This creates what the EFF calls a “liability trap.” If a website cannot reliably detect a VPN user’s true location, it faces legal risk. As a result, sites may choose to block all known VPN IP addresses or require age verification for every visitor globally—even those outside Utah.
The Liability Trap
As the EFF argued in the Wisconsin case, this legal pressure can have far-reaching consequences. Websites may opt for invasive identity checks (such as uploading government IDs) or simply block VPN users altogether. This affects not just Utahns but anyone worldwide who relies on VPNs for privacy, security, or accessing region-restricted content.
Comparison with Wisconsin
Utah’s law differs from a similar proposal in Wisconsin, which was ultimately withdrawn after strong opposition from privacy advocates and constitutional concerns. Wisconsin’s bill included a near-total VPN ban, whereas SB 73 stops short of that. Instead, it discourages VPN use by imposing liability on websites and by restricting the sharing of VPN-related information. However, privacy experts warn that the Utah law’s indirect coercion could still have a chilling effect on digital anonymity.
What This Means for Privacy
If SB 73 sets a precedent, other states may follow suit with their own versions of VPN-targeting age verification laws. The result could be a fragmented internet where users’ privacy is compromised not by a single surveillance measure, but by a patchwork of state-level mandates. For now, Utah is the first to test this approach, and the outcomes will be closely watched by civil liberties organizations, tech companies, and internet users alike.
Key Takeaways
- Effective date: May 6, 2026.
- Primary target: Websites hosting “material harmful to minors” must verify ages of Utah residents, even if they use VPNs.
- Indirect effect: VPN users worldwide may face blocked access or mandatory age checks on many websites.
- Privacy implications: The law undermines the anonymity that VPNs provide, potentially leading to broader surveillance measures.
Conclusion
Utah’s SB 73 represents a significant shift in how states approach digital age verification. Rather than accepting that VPNs are a natural response to privacy-invasive laws, Utah is attempting to regulate the workaround. As the law takes effect, it remains to be seen whether it will achieve its stated goal of protecting minors or simply drive more users to less transparent tools—and whether other states will adopt similar measures. For now, anyone concerned about online privacy should stay informed and consider the potential impact on their own browsing habits.