Starting May 6, 2026, Utah will enforce a controversial law that directly targets Virtual Private Networks (VPNs) used to bypass age verification gates. Senate Bill 73 (SB 73) aims to force websites with adult content to verify the age of all visitors physically located in Utah, even if those visitors use VPNs or other tools to mask their location. Critics argue this creates a dangerous precedent for digital privacy. Below, we answer key questions about the law, its implications, and what it means for internet users.
What exactly is Utah's SB 73 law, and when does it take effect?
Utah’s Online Age Verification Amendments, also known as SB 73, was signed by Governor Spencer Cox on March 19, 2026. The law has two main parts: a 2% tax on revenue from online adult content (effective October 2026) and a section regulating VPN use that goes into effect on May 6, 2026. This makes Utah the first U.S. state to impose restrictions on VPN usage for bypassing age gates. The law requires commercial entities hosting a substantial portion of material harmful to minors to verify the age of anyone physically located in Utah, regardless of whether they use a VPN or proxy server to hide their location.
How does the law specifically target VPN usage?
SB 73 addresses VPNs in two primary ways. First, it defines an individual as accessing a website from Utah if they are physically present there, even if they use a VPN to mask their geographic location. This means websites must attempt to verify the true location of all visitors from Utah, including those using VPNs. Second, the law bans commercial entities that host harmful-to-minors content from facilitating or encouraging VPN use to evade age checks. This includes providing instructions on how to use a VPN or offering tools to circumvent geofencing. Companies that violate these provisions could face legal liability.
Why does the Electronic Frontier Foundation (EFF) criticize this law?
The EFF has strongly opposed SB 73, arguing that it undermines digital privacy rights. In previous cases, such as the Wisconsin bill, advocates successfully removed similar VPN provisions due to constitutional and technical concerns. The EFF warns that the law creates a "liability trap"—if a website cannot reliably detect a VPN user's true location but the law requires it to, the site may either block all known VPN IP addresses or require age verification for every visitor globally. This, the EFF explains, subjects millions of users to invasive identity checks or blocks, regardless of where they live.
What is the "liability trap" created by the law?
The liability trap is a key criticism of SB 73. Under the law, commercial websites that host material harmful to minors must verify the age of anyone physically in Utah—even those using VPNs. However, detecting a VPN user's true location is technically challenging and often inaccurate. To avoid legal risk, many companies will likely choose to either ban all known VPN IP addresses entirely, or implement age verification for all visitors worldwide. Either approach forces users to either lose access to VPNs (a common privacy tool) or submit to invasive identity checks, even if they live outside Utah. This effectively penalizes everyone for the law’s enforcement.
How does this law differ from the failed Wisconsin proposal?
Both Utah’s SB 73 and the Wisconsin proposal aimed to restrict VPN use for bypassing age gates, but Wisconsin’s bill was withdrawn after advocacy from groups like the EFF. Utah’s law stops short of a total VPN ban. Instead, it discourages VPN use by imposing liability on companies that encourage or facilitate VPN bypass. Unlike Wisconsin, Utah does not make VPN usage itself illegal for individuals. However, the effect may be similar: by forcing websites to verify all Utah visitors, the law pressures sites to restrict VPN access or introduce universal age gates, which critics argue is a de facto restriction on privacy.
What are the potential consequences for websites and users?
For websites that host adult content, the consequences are significant. They must either invest in reliable location detection (often impossible when VPNs are used) or comply with the law by blocking all VPN traffic or verifying every visitor's age. This could lead to a fragmented internet where users in Utah (or those appearing to be in Utah) are denied access or forced to share personal identification. For regular users, the law may result in loss of anonymity and increased surveillance. Even those who don't use VPNs could be affected if sites introduce blanket age verification, requiring everyone to submit IDs or credit card information just to browse.
What can users do to protect their privacy under this law?
While SB 73 targets users' ability to use VPNs to bypass age gates, individuals can still take steps to protect their privacy. First, consider using reputable VPN providers that offer strong encryption and no-logs policies—though be aware that sites may block VPN IPs. Second, advocate for less invasive age verification methods, such as anonymous tokens or third-party verification services that don't require sharing personal data. Third, support organizations like the EFF that are challenging the law on constitutional grounds. Finally, stay informed about future bills in other states—similar proposals may emerge, and public input can help shape better, privacy-respecting alternatives.