Utah Becomes First US State to Restrict VPN Use for Bypassing Age Verification – Law Takes Effect May 6
Utah enacts first US law targeting VPNs to bypass age verification, effective May 6, 2026. Critics warn it creates liability trap, threatens privacy.
Breaking: Utah’s Anti-VPN Law Goes Live Next Week
Starting May 6, 2026, Utah will become the first U.S. state to explicitly penalize the use of virtual private networks (VPNs) to circumvent age-verification gates. The law, signed by Governor Spencer Cox on March 19, 2026, targets both individuals and commercial websites in a bid to enforce mandatory age checks on adult content.
Under Senate Bill 73 (SB 73), anyone physically located in Utah is considered to be accessing a website from the state — even if they use a VPN or proxy to hide their location. Websites hosting “material harmful to minors” are now forbidden from sharing instructions on how to use VPNs or from actively facilitating circumvention of geofencing.
Privacy advocates warn the measure creates a “liability trap” that could force global websites to impose invasive age verification on all visitors or block VPN users entirely. “This law doesn’t ban VPNs outright, but it makes using one legally risky, and that’s a direct threat to digital privacy,” said Elizabeth Moore, staff attorney at the Electronic Frontier Foundation (EFF).
Background
SB 73, officially titled the “Online Age Verification Amendments,” was passed alongside a 2% tax on revenues from adult content, which takes effect in October 2026. The VPN provisions, however, go into force on May 6. The law amends Utah Code Section 78B-3-1002 and is modeled after a controversial Wisconsin proposal that was withdrawn after constitutional and technical pushback.
Unlike the Wisconsin bill, which proposed a near-total VPN ban, Utah’s version stops short of outright prohibition. Instead it imposes liability on commercial entities for failing to verify the age of any user physically in Utah — even those cloaked by VPNs. Experts say this effectively pressures sites to adopt universal age gates or geoblock all known VPN IP addresses.
What This Means
The practical impact could be sweeping. Websites that cater to global audiences may now face a choice: require age verification for every visitor, or block VPN traffic outright. Both options compromise user privacy and access to legitimate content, critics argue.
“This sets a dangerous precedent,” Moore added. “If other states follow Utah’s lead, VPNs could become practically unusable for millions of people who rely on them for security, journalism, or simply avoiding surveillance.” The law also bans online platforms from providing “means to circumvent geofencing,” which could extend to sharing links to VPN providers or step-by-step tutorials.
- Location-based liability: Websites must verify the age of any user physically in Utah, regardless of VPN use.
- Instruction ban: Commercial sites hosting adult content cannot share VPN instructions to bypass age checks.
- First of its kind: Utah is the only U.S. state with such a provision as of May 6, 2026.
For now, the law applies only to adult content platforms. But privacy groups caution that similar requirements could later be expanded to social media, news sites, or any platform with age-restricted material. The EFF has called on Utah lawmakers to reconsider, but no amendments are expected before the effective date.