On Wednesday, Utah will become the first U.S. state to write VPN use directly into an online age-verification law, setting up a collision between child-safety regulation, website liability and a privacy tool used by businesses, journalists, abuse survivors and everyday internet users.
Senate Bill 73, Utah’s “Online Age Verification Amendments,” takes effect May 6, with some tax provisions following Oct. 1. The law attempts to close the VPN loophole by saying a person actually located in Utah is still a Utah user, even if a VPN, proxy server or similar tool makes the user appear to be somewhere else.
For non-Utah residents, the law does not directly regulate them unless they are physically in Utah. But non-Utah residents could still feel the impact of SB 73 if websites overcorrect – by blocking VPN traffic, misreading your location or rolling out age checks more broadly to avoid Utah liability.
For state residents attempting to skirt age verification with a VPN spoofing their location beyond Utah’s borders, the law adds extra obstacles placed between the user and the site—not necessarily criminal penalties or direct punishment. For Utah VPN users in general, the mere use of a VPN may trigger a site to require an ID check, facial age estimate, credit card verification, or a third-party age-verification process.
VPN companies are expected to feel the squeeze as well. While the law does not ban VPNs directly, it makes VPN use legally radioactive for the websites that have to comply. By treating Utah users as Utah users – even when they mask their location – the law turns VPN traffic into a compliance challenge for websites.
Sites that cannot reliably determine where a VPN user is phystically located may respond by blocking known VPN IP addresses. That puts VPN companies in a pickle. Even though their products remains legal, their value to their customers could be degraded wherever websites decide privacy tools now carry too much liability.
The law applies to commercial websites that contain a “substantial portion” of material deemed harmful to minors. It also creates a 2% excise tax on covered transactions, effective Oct. 1, and gives Utah’s Division of Consumer Protection authority to enforce age-verification rules. It also bars covered sites from encouraging visitors to use VPNs or proxies to get around Utah’s age checks.
Supporters frame the law as a long-overdue effort to require adult-content platforms to keep minors out. “We have a responsibility as a state to, No. 1, protect our minors, but also to facilitate a path forward that they can have healthy relationships in their adulthood,” Utah Sen. Calvin Musselman, the bill’s sponsor, told the Deseret News.
The Utah fight may be about adult websites, but it is striking a nerve with privacy and free speech groups, including the Electronic Frontier Foundation, who say the VPN rule treats a privacy and security tool as a loophole to close.
Privacy-first advocates raise concerns
The security concern is that VPNs are not only used to dodge location checks. They also protect remote work sessions, shield journalists’ communications, secure traffic on public Wi-Fi and help people hide from stalkers or abusive partners.
David Inserra of the Cato Institute, a libertarian think tank, argued in January that attacking VPNs to preserve age verification strikes a blow to personal privacy and security. If Utah’s enforcement of SB 73 is so threatened by a VPN, “maybe the policy is the problem.”
Utah’s law stops short of banning VPNs outright. EFF noted that the law is not as aggressive as a discarded Wisconsin proposal but said it still creates a “dangerous precedent” by discouraging VPN use and preventing websites from sharing basic information about a lawful privacy tool.
NordVPN told TechRadar in March that the law creates an “unresolvable compliance paradox” and a “liability trap,” arguing that the statute could punish lawful users worldwide while failing to stop minors from finding workarounds.
The company said blocking all known VPN and proxy IP addresses is “technically impossible” because providers constantly add new addresses and no comprehensive blocklist exists.
Experts say enforcement poses a technical challenge that will make the age-verification rules nearly impossible to enforce.
Technical and enforcement challenges
“These provisions won’t stop a tech-savvy teenager, but they certainly will impact the privacy of every regular Utah resident who just wants to keep their data out of the hands of brokers or malicious actors,” wrote Rindala Alajaji, associate director of state affairs at EFF. A less technical adult using a mainstream VPN for privacy may simply hit a wall.
She noted that deep packet inspection can identify VPN protocol signatures, but that requires network-level access more typical of ISPs or state-controlled filtering systems, not ordinary website operators.
IP reputation databases can flag traffic from known data centers, but VPN providers rotate addresses, residential VPN endpoints can look like ordinary home broadband, and self-hosted tunnels can be spun up on cloud infrastructure. It is a classic game of cat and mouse.
The practical problem at the center of SB 73 is that a law may be able to declare that a VPN user is still “in Utah.” It cannot necessarily make a website know that.
EFF makes the same point, calling VPN blocking “a technical whack-a-mole that likely no company can win.” EFF warned that providers could respond by blocking known VPN IP addresses, sweeping in legitimate users, or by imposing age verification on every visitor globally to reduce legal risk.
The impending age-verification tidal wave
Age verification is moving beyond adult-content sites.
Governments are increasingly looking at age checks, parental controls, default privacy settings, time limits and restrictions on addictive design features as ways to reduce social media harms to minors and young adults.
New Mexico is seeking age verification and limits on features such as infinite scroll and push notifications in its youth-harm case against Meta.
The U.S. Supreme Court last year upheld a Texas law requiring age verification on pornographic websites, a ruling that gave states more room to pursue these laws and encouraged similar efforts elsewhere. Reuters reported at the time that 24 similar measures had been enacted around the country, according to the Free Speech Coalition.
EU regulators have pressed Meta over whether it keeps underage users off Facebook and Instagram.
The U.K. House of Lords voted 207-159 in January for an amendment aimed at prohibiting VPN services for children, while the U.K. children’s commissioner has called VPNs a loophole that needs closing.
France has moved in a similar direction. After lawmakers advanced social media restrictions for children under 15, Digital Affairs Minister Anne Le Hénanff said VPNs were “the next topic on my list,” according to Engadget.
Australia’s under-16 social media restrictions took effect in December.
Image by Gerd Altmann from Pixabay
