Starting May 6, Utah becomes the first U.S. state to hold websites legally liable when visitors use a VPN to bypass age verification - a provision that could reshape how platforms handle identity checks far beyond state lines. The law, known as the Online Age Verification Amendments, doesn't ban virtual private networks outright, but it creates a legal environment where ignoring them is no longer an option for any site that hosts content deemed harmful to minors.
What the Law Actually Does - and Doesn't Do
SB 73 works through liability rather than technical enforcement. Under the new rules, anyone physically located in Utah is legally considered to be accessing the internet from within the state, regardless of what tools they use to mask their location. A VPN, a proxy server, a residential relay - none of these change a user's legal status under Utah law. If a minor uses one of those tools to slip through an age gate, the website on the other end bears responsibility.
The law goes further in a way that has drawn sharp criticism from digital rights advocates. Websites that host a substantial portion of content harmful to minors are prohibited from explaining, encouraging, or even mentioning VPN use as a workaround for age verification. An adult platform cannot publish a privacy guide, post a social media thread, or send a newsletter describing how users can protect their anonymity while visiting the site. That restriction reaches into speech, not just conduct.
The Electronic Frontier Foundation has noted a practical obstacle that Utah's legislators appear to have underestimated: there is no comprehensive blocklist of VPN IP addresses. Providers continuously rotate their address pools, and residential proxies - which route traffic through ordinary consumer internet connections - are functionally indistinguishable from standard home users. Blocking known VPN infrastructure would catch some users while missing many others.
The Liability Trap and Its Ripple Effects
Because websites cannot reliably detect every masked connection, SB 73 creates an asymmetric burden. A platform that tries to comply and fails anyway - because a determined minor used an undetectable proxy - still faces legal exposure. The rational response for many platforms will not be better VPN detection; it will be blanket age verification for every visitor, regardless of location, to ensure no Utah minor slips through unchecked.
That outcome is almost certainly intentional. Utah is effectively exporting its age verification standard by making non-compliance legally risky for any site with a Utah-accessible audience. A platform that geo-blocks Utah entirely avoids the liability, but loses that market. A platform that imposes universal ID upload requirements satisfies the law but imposes that burden on users everywhere. Neither outcome is neutral for the broader internet.
The law also introduces a 2% tax on adult content revenue beginning in October, adding a financial dimension to what began as a child protection measure. Together, the provisions signal a legislative approach that treats online content platforms more like regulated industries than open communication channels - a conceptual shift with implications well beyond Utah's borders.
Age Verification Is Coming. The Debate Is About the Mechanism
Utah is not acting in isolation. A growing number of U.S. states and several national governments have moved to require age verification for access to adult content, social media platforms, or both. The policy rationale is consistent: minors are accessing content that most societies agree they should not, and self-certification - clicking a box to confirm you are over 18 - has proven meaningless as a barrier.
The technical alternatives carry their own trade-offs. Government ID uploads create privacy risks and data security obligations for platforms that were never designed to handle sensitive identity documents. Third-party age verification services shift the liability but introduce new intermediaries with access to browsing behavior and personal records. Biometric checks raise civil liberties concerns that privacy regulators in Europe, in particular, have scrutinized closely.
VPNs complicate all of these approaches because they serve legitimate purposes well beyond circumventing content restrictions. Journalists, corporate employees, travelers, and privacy-conscious individuals depend on them daily. A regulatory framework that treats VPN use as presumptive evidence of bad intent - as SB 73 effectively does - catches a far wider population than underage users seeking restricted content.
The Risk of a Precedent Built on Uncertain Engineering
Laws that try to solve technical problems through legal liability tend to produce compliance theater rather than genuine results. Websites will respond to SB 73 by doing what is legally defensible, not necessarily what is technically effective. The minors most determined to access restricted content are also, by and large, the most capable of finding workarounds that no verification layer will catch.
What remains after enforcement begins is a patchwork of obligations that falls most heavily on law-abiding users and platforms. Adults who use VPNs for entirely unrelated reasons will encounter friction or outright blocks. Companies will face legal uncertainty about obligations they cannot fully satisfy. The goal of protecting minors is legitimate and serious. The mechanism chosen in Utah, however, distributes its costs unevenly - and sets a precedent that other legislatures will be tempted to replicate before its actual effects are understood.
