Utah's New VPN Laws Could Have A Huge Effect On How You Use The Internet

As parents scramble to protect their children from the adverse effects of a free and open internet, lawmakers are increasingly restricting access to untoward content via age verification laws. Enforcement, however, has proven difficult, with constituents often flocking to tools like virtual private networks to circumvent restrictions. As a response, lawmakers have advocated restricting access to VPNs, which camouflage a user's location by spoofing their IP address. While VPN restrictions have been deployed in totalitarian countries like North Korea, Belarus, China and Russia, age limits that necessitate them to enforce are increasingly popular in liberal nations like the U.K. and Australia. Some American states, like Wisconsin and Michigan, have attempted to codify VPN bans. On May 6, 2026, Utah became the first state to officially effectively combat users' access to the privacy tool.

Utah's state Senate Bill 73, dubbed Online Age Verification Amendments, was signed by Utah's Republican governor Spencer Cox in March. The law, which largely focuses on taxing websites exhibiting adult content, sets several age verification provisions. Critically, SB73 shifts liability for minors accessing adult content onto the websites themselves. This constitutes a major shift in the state's content censorship rules, as online providers will be legally liable for verifying the age of all users located in Utah, regardless of if they're using a VPN to mask their location. 

Advocates argue that such provisions act as a soft VPN ban, potentially forcing websites to prevent all traffic from known VPN IP addresses. While this form of enforcement is significantly less extreme than some proposed bans, specifically Wisconsin's now-abandoned law which sought to ban the technology outright, Utah's new restrictions could prove a watershed moment for American censorship online. Advocates warn the move creates a dangerous precedent with major implications for national censorship laws. 

To ensure that Utah residents adhere to the state's new age restriction rules, SB73 imposes two new provisions concerning VPN usage. The first extends companies' legal liability for users violating the state's age regulations, requiring companies to restrict access from any underage users physically located in the state. Second, it prevents entities with "a substantial portion of material harmful to minors" from sharing information related to VPNs.

Although these may sound like minor changes, advocates worry that they could force websites to indiscriminately apply age verification measures. For one, websites cannot accurately determine VPN users' true locations, potentially forcing companies operating in Utah to apply age verification rules across a VPN company's entire customer base. Determining who's using a VPN, for that matter, is equally difficult, since VPN companies routinely add new IP addresses, rendering VPN blacklists ineffective. In a statement given to TechRadar, popular VPN provider NordVPN gave the issue the moniker of a "liability trap." Because Utah's age restriction mandate is essentially unenforceable, NordVPN argues, it forces websites into making age verification rules universal, and thus subjecting  "millions of users to invasive identity checks [when] they have no legal obligation."

It's important to note that Utah's restrictions are not a hard-and-fast mandate. Instead, it deploys what the Electronic Frontier Foundation, a non-profit focused on defending digital rights, dubs a "don't ask, don't tell" policy, in which "websites likely only have an obligation to ask for proof of age if they actually learn that a user is physically in Utah and using a VPN." Rather than assuage concerns, however, EFF argues that such legal uncertainties create "a dangerous precedent" that "threatens to significantly undermine digital privacy rights."

This discussion must be held within the context of the broader age verification debate, which activists argue unduly infringes on users' privacy. To enforce age restriction rules, websites must require access to sensitive information, ranging from government IDs and biometric data to users' online browsing histories. Increasingly, websites like Google are feeding some amalgamation of this data into AI algorithms to determine user's ages. According to EFF, each of these age verification methods "demands users hand over sensitive and immutable personal information that links their offline identity to their online activity." Some activists argue that age verification rules function more to feed surveillance structures than safety measures. Furthermore, users worry that providing personal data creates major security concerns, exemplified by a slew of high-profile hacks of age verification providers in recent years.

As the first American age verification law to directly address VPN usage, Utah's SB73 sets a dangerous precedent while offering little practical utility. By roping VPNs into its online censorship laws, Utah expands the Overton Window for American lawmakers looking to restrict constituent's online activities. In doing so, the ban potentially sets the stage for more invasive restrictions without making its constituents' online lives any safer. In fact, Utah's SB73 exemplifies a legal paradigm in which privacy measures are increasingly treated as "loopholes" rather than security tools. 

Utah is far from the only jurisdiction pushing for more invasive age verification rules. As governments around the world look to mitigate minor's exposure to social media, pornography, and other sensitive materials, VPNs have increasingly found themselves in the crosshairs. Ultimately, restricting their usage potentially causes more damage than benefits.