Utah has become the first U.S. state to specifically target the use of VPNs in legislation, raising alarms among digital rights advocates, privacy researchers, and everyday internet users. Senate Bill 73, signed into law on March 19, 2026, represents a significant escalation in the national debate over online age verification - one that reaches far beyond adult content into the heart of how Americans use the internet.
What Utah's SB 73 VPN Law Actually Does
The law, formally titled the "Online Age Verification Amendments," imposes two categories of obligations on websites. First, commercial entities hosting content deemed "harmful to minors" must treat any user physically located in Utah as a Utah resident - regardless of whether they are connecting through a VPN, proxy, or any other anonymizing tool. Second, and more controversially, these platforms are prohibited from providing VPN instructions or any technical means that would help users circumvent Utah's geographic restrictions.
The law went into effect on May 6, 2026. However, following a legal challenge filed by Aylo - the parent company of Pornhub - enforcement was postponed until September 3, 2026. That pause gives legislators and platforms time to respond, but it does not change the law itself.
The Technical Challenge of Blocking VPN IP Addresses
Enforcing geographic restrictions against VPN users is, by design, nearly impossible. There is no comprehensive, real-time list of VPN and proxy IP addresses. VPN providers constantly rotate addresses, add new servers, and operate through residential IP networks that are indistinguishable from regular home connections. This is not a gap that legislation can close - it is an architectural feature of how the internet works.
This leaves websites in an unworkable position. To comply with Utah's SB 73, platforms face three equally problematic choices:
- Block all suspected VPN IPs globally: This would cut off legitimate users - remote workers, travelers, journalists - around the world.
- Require age verification from every visitor: This forces unnecessary data collection on users in countries where no such requirement exists.
- Accept the legal risk: Sites that discover a user is physically in Utah while connected via VPN face liability, even if they had no way to know.
The Electronic Frontier Foundation (EFF), which has closely tracked the law, describes this as a "liability trap." The law's "don't ask, don't tell" structure means sites are only liable if they discover the location - which paradoxically encourages invasive tracking to avoid legal exposure.
First Amendment Concerns for VPN Providers and Sites
Legal scholars and civil liberties organizations have flagged a core constitutional problem: the law restricts what companies can say. Informing users about legal privacy tools - including how to use a VPN - is speech protected by the First Amendment. By banning platforms from sharing that information, Utah's legislature is effectively silencing truthful speech about lawful technology.
This type of content-based restriction on commercial speech faces serious scrutiny under U.S. constitutional law. The Aylo legal challenge touches on precisely this issue, and observers expect the First Amendment argument to be central to any court proceedings before the September 3 enforcement date.
Who Gets Caught in the VPN Ban Crossfire
The stated goal of SB 73 is protecting minors from adult content. But the law's reach extends far beyond its target. Among the most affected groups:
- Journalists and activists: Many use VPNs as a basic security tool when covering sensitive topics or communicating with sources.
- Domestic abuse survivors: Survivors frequently use VPNs to mask their location and avoid being tracked by abusers - a legitimate safety measure that would now make them invisible to compliant platforms.
- Remote workers and travelers: Anyone accessing the internet through a corporate VPN while physically in Utah could trigger the law's provisions at sites they visit routinely.
- Privacy-conscious users: People who use VPNs for general security rather than content access could find themselves blocked from sites that adopt blanket IP bans.
The EFF notes that "the internet is built to, and will always, route around censorship" - meaning the minors the law aims to protect are unlikely to be stopped, while collateral damage falls on users with entirely legitimate reasons to protect their online identity.
What Comes Next for VPN Users in Utah
Enforcement is currently set to begin September 3, 2026. Between now and then, the legal challenge from Aylo may result in an injunction that blocks enforcement entirely. Courts will need to weigh the state's interest in child protection against the First Amendment claims and the technical impossibility of consistent enforcement.
Utah is not operating in isolation. Several other states have passed age verification laws, though none have gone as far as explicitly targeting VPN use. If SB 73 survives legal challenge, it could become a template for other states - and a signal to lawmakers worldwide that targeting the tools of online privacy is politically viable.
For users who rely on VPNs to maintain their privacy and access the web securely, the Utah law represents a meaningful escalation. It is the first time a U.S. government body has explicitly named VPN use as a problem to be legislated against - not as a cybersecurity concern, but as a mechanism that enables users to exercise their own privacy rights.
