Utah Enforces First‑In‑Nation VPN Restrictions Under SB 73

Context For years, states have introduced age‑verification requirements for online adult material, prompting spikes in VPN use as users seek privacy. Utah joins Florida, Missouri, Texas and others in imposing age gates, but it is the first to target the VPN tools themselves.

Key Facts - SB 73, signed by Governor Spencer Cox on March 19, 2026, adds a Section 14 amendment to Utah’s statutes. It defines a user as “physically located in Utah” regardless of VPN, proxy or other masking technology. - The law bars commercial websites that host a “substantial portion of material harmful to minors” from sharing VPN instructions or tools that would let users bypass age‑verification checks. - Companies that fail to comply could face liability for serving under‑age users, creating a risk that they may block all known VPN IP addresses or require age verification from every visitor worldwide. - The Cato Institute, a public‑policy think tank, argues that targeting VPNs to enforce age verification harms online speech and privacy.

What It Means The provision does not outlaw VPN use outright; instead it imposes a “don’t ask, don’t tell” regime. Websites must verify age only if they can confirm a user is in Utah and using a VPN. In practice, the requirement forces sites to either develop costly detection systems or adopt blanket bans that affect all users, including journalists, survivors of abuse and ordinary residents who rely on VPNs for security. Technical experts note that blocking VPN and proxy IP addresses is a perpetual “whack‑a‑mole” effort, as providers constantly rotate addresses. Users are likely to shift to private cloud tunnels or residential proxies that mimic normal traffic, undermining the law’s effectiveness while expanding collateral damage. If Utah’s approach survives legal challenges, other states may adopt similar measures, reshaping the balance between age‑verification policies and digital privacy rights.

Looking ahead, courts will decide whether SB 73’s restrictions withstand First Amendment scrutiny, and tech companies will test how to comply without crippling user privacy.