Utah is set to become the first U.S. state to enforce a law that directly targets VPNs for age verification, raising significant privacy concerns. Senate Bill 73, also known as Utah’s Online Age Verification Amendments, will go into effect on May 6, 2026, marking a pivotal moment in digital privacy legislation.
The law aims to ensure that adult websites verify the ages of their users, even if they are accessing the sites through a VPN. This requirement places the responsibility of compliance squarely on companies operating these websites. But how can they accurately verify ages when users mask their locations? This creates a complex liability situation for businesses.
Key facts:
- The law mandates that companies are liable for age verification even if users employ a VPN.
- It prohibits adult websites from providing instructions on circumventing age checks using VPNs.
- The Electronic Frontier Foundation warns this could subject millions of users to invasive identity checks.
Signed into law by Governor Spencer Cox on March 19, 2026, this legislation reflects a broader trend among governments targeting VPNs as obstacles to online regulation. The intent is clear: to restrict access to adult content while ensuring compliance with age verification standards. However, critics argue that it represents an alarming encroachment on digital privacy rights.
The implications of this law extend beyond mere compliance issues; they touch upon fundamental questions about First Amendment rights and free speech. As NordVPN aptly pointed out, “Blocking all known VPN and proxy IPs is a technical whack-a-mole that likely no company can win.” This highlights the inherent challenges in enforcing such regulations without infringing upon personal freedoms.
That context matters because it illustrates the delicate balance between protecting minors online and preserving individual privacy rights. The law does not explicitly ban VPN usage but effectively discourages it through potential liability traps for website operators who cannot reliably detect user locations.
As Utah moves forward with this groundbreaking legislation, uncertainties loom large. The effectiveness of the law in enforcing age verification remains unclear. Additionally, the potential for websites to comply without violating user privacy is uncertain as well. With the stakes high for both users and companies alike, this law could set a precedent for similar measures across other states.
The upcoming enforcement date of May 6, 2026, will be crucial. It will reveal how businesses adapt to these new regulations and how individuals respond to increased scrutiny over their online activities.