On May 6, 2026, Utah's new age-verification law creates a new liability problem around VPN use. The law does not say "VPNs are banned," but it can pressure websites to block VPN traffic or verify far more users than intended. What SB 73 Actually Does Senate Bill 73, the "Online Age Verification Amendments," was signed by Governor Spencer Cox on March 19, 2026. Most coverage focused on the 2% tax on adult website revenue. The VPN provisions are the real story. Section 14 amends Utah statute 78B-3-1002 in two ways: No VPN can hide your location. Under the law, a person is considered to be accessing a website from Utah if they are physically located there — regardless of whether they use a VPN, proxy server, or any other means to disguise their geographic location. Websites cannot mention VPNs. Commercial entities that host "a substantial portion of material harmful to minors" are now prohibited from facilitating or encouraging VPN use to bypass age checks. This includes providing instructions on how to use a VPN or linking to VPN services. The First Amendment problem is immediate. The government is telling websites they cannot provide truthful information about a legal privacy tool. As the EFF put it: this is a "don't ask, don't tell" enforcement model that silences platforms from even discussing VPNs. The Liability Trap Here's how this plays out in practice. A website cannot reliably detect whether a VPN user is physically in Utah. But the law requires it to verify the age of anyone in Utah, VPN or not. Faced with legal exposure, websites have two choices: Block all known VPN IP addresses. This is a technical whack-a-mole that no company can win. VPN providers add new IPs constantly. No comprehensive blocklist exists. Mandate age verification for every visitor globally. If you can't tell who is in Utah, you verify everyone. This subjects hundreds of millions of users to invasive identity checks regardless of where they live. NordVPN called the law a "liability trap" and an "unresolvable compliance paradox." They're right. The law demands a technical impossibility and makes companies liable for failing to achieve it. The Wisconsin Warning Utah isn't the first state to propose these restrictions. Wisconsin introduced similar VPN provisions in SB 130 / AB 105. After widespread backlash — including from the EFF, which argued the provisions were both unconstitutional and technically unworkable — Wisconsin lawmakers removed the VPN language entirely on February 25, 2026. Utah looked at that outcome and proceeded anyway. Who This Actually Hurts The legislators drafting these bills imagine a teenager bypassing a porn block. The collateral damage falls on everyone else: Journalists who use VPNs to protect sources Domestic abuse survivors who rely on VPNs for safety from stalkers Businesses that use VPNs for secure remote access Regular residents who just want their ISP to stop selling their browsing data The Cato Institute summed it up: "When an internet policy can be avoided by a relatively common technology that often provides significant privacy and security benefits, maybe the policy is the problem." The Workaround Problem If Utah's law successfully blocks commercial VPN providers, users won't stop using VPNs. They'll migrate to: Private tunnels through cloud services like AWS or Google Cloud Residential proxies that are indistinguishable from standard home traffic Non-commercial proxies and self-hosted solutions Tor and other anonymizing networks These workarounds will emerge within hours of enforcement. The law will fail at its stated goal while succeeding at making everyone less safe. Commercial VPNs have terms of service, security audits, and accountability. Underground proxies have none of that. The Global Pattern This law does not exist in isolation. The UK Children's Commissioner has called VPNs a "loophole that needs closing." France's Minister Delegate for Artificial Intelligence and Digital Affairs said VPNs are "the next topic on my list" after the country banned social media for children under 15. Australia's mandatory age verification rollout triggered a documented surge in VPN usage, and regulators there are watching. Historically, aggressive VPN restrictions have been associated with countries such as China, Russia, Iran, and the UAE. Utah's law is narrower, but it gives other states a template for turning age-verification mandates into pressure on privacy tools. What SB 73 Doesn't Do — Yet The law stops short of a total VPN ban. Unlike earlier Wisconsin drafts, it doesn't criminalize VPN use or prohibit VPN companies from operating. It's a "don't ask, don't tell" framework: websites only have obligations if they actually learn a user is in Utah and using a VPN. This is not restraint. This is testing the waters. If SB 73 survives legal challenge, the next bill will go further. The pattern is established: age verification mandates fail, so lawmakers attack the tools people use to maintain privacy. Each step normalizes the next. What You Can Do The EFF is opposing this law on First Amendment and technical feasibility grounds. Legal challenges are likely. In the meantime: Contact Utah legislators. Make it clear that attacking VPNs to enforce a failed age-verification framework is not acceptable. Support the EFF. They are the primary organization fighting this at the state and federal level. Use a VPN now. Normalize VPN usage. The more people who use these tools for legitimate purposes, the harder they are to paint as a "loophole." Check your VPN's privacy. Not all VPNs are equal. Verify that your provider has a proven no-logs policy and operates outside Five Eyes jurisdiction. This is the test case. If Utah succeeds, the legislative template is written. Every state privacy battle from here forward will include a VPN provision — unless this one is stopped. --- Check if your VPN still protects you: Use our VPN audit tool