Utah to Penalize VPN Use for Evading Age‑Verification Starting May 6, 2026

Utah will fine websites that help users hide their location with a VPN to avoid state age‑verification rules, effective May 6, 2026.

The Online Age Verification Amendments (SB 73) were signed by Governor Spencer Cox on March 19, 2026. While most of the bill introduces a 2% tax on online adult‑content revenue, Section 14 targets VPN use by deeming a user physically present in Utah regardless of VPN or proxy use. It also bars commercial sites that host substantial harmful‑to‑minors material from providing VPN instructions or tools that facilitate evasion.

The Cato Institute warns that targeting VPNs to circumvent age‑verification worsens online speech and privacy harms. Critics argue the liability trap may force platforms to either block known VPN IP ranges or impose age checks on all visitors, affecting journalists, abuse survivors, and everyday users who rely on VPNs for security.

For security teams, the law means reviewing geolocation controls and updating acceptable‑use policies. Organizations should verify that their age‑verification vendors do not inadvertently disclose VPN usage guidance. Implementing detection for VPN traffic patterns and maintaining allow‑lists of trusted providers can reduce false positives. Regularly auditing third‑party content hosts for compliance with the new disclosure ban is also advised.

Watch for legal challenges that may clarify the law’s reach and for any state‑level amendments that could modify enforcement before the May 6 effective date.