Utah’s VPN rules take effect next week

Utah is set to become, to the Electronic Frontier Foundation’s knowledge, the first state in the country to target VPN use as part of an age-verification law. The measure takes effect May 6, 2026, and privacy advocates say it could pressure websites to block VPN traffic or expand invasive identity checks far beyond Utah’s borders.

The law, Senate Bill 73, was signed by Gov. Spencer Cox on March 19, 2026. Officially titled the “Online Age Verification Amendments,” the statute is aimed mostly at adult-content regulation, including a 2% tax on online adult content revenues that is scheduled to begin in October. But the provision drawing the most immediate concern is Section 14, which amends existing Utah law to address VPN use directly.

Under the new language, companies can be held liable for verifying the age of anyone physically in Utah, even if that person is using a VPN. That creates what advocates describe as a liability trap: if a website cannot reliably determine a user’s true location, it may respond by blocking known VPN IP addresses altogether or by requiring age verification from every visitor, everywhere.

Unlike a more sweeping proposal in Wisconsin that was dropped over constitutional and technical concerns, Utah’s law does not explicitly ban VPNs. Instead, it appears designed to discourage them indirectly by shifting legal risk onto websites and limiting what those platforms can say about VPNs. That aspect has raised First Amendment concerns, since it could prevent sites from sharing basic, truthful information about a lawful privacy tool.

The enforcement picture is also murky. The law appears to rely on a “don’t ask, don’t tell” approach: a website may have an obligation to seek proof of age if it actually learns a user is physically in Utah and using a VPN. But if a site does not know the user is in Utah, the broader duty to police VPN use remains unclear.

For now, Utah’s move adds a new front in a broader fight over age gates, online anonymity, and how far states can go in regulating the tools people use to protect their privacy online.

Sources:

eff.org