Utah has become the first state in the U.S. to directly target VPN use as part of an age-verification crackdown, pushing the digital-rights fight into new territory.
The state now requires websites that host adult material to verify visitors’ ages even when those users conceal their location through VPNs. In practice, operators are responsible for determining whether a visitor is physically located in Utah.
SB 73 ties VPN use directly to age-check compliance
Utah’s SB 73 says commercial websites that “knowingly and intentionally publish or distribute material harmful to minors” must verify the age of Utah visitors if that material accounts for more than one-third of their content. That obligation applies even when a visitor hides location data through a VPN or proxy.
The bill states: 「A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements.」
Under the law, anyone physically located in Utah is treated as a Utah user regardless of whether they use a virtual private network, proxy server, or another tool to disguise location. VPNs route traffic through remote servers, masking the IP address a website would otherwise see.
The measure also restricts operators from helping visitors get around age checks. That includes publishing instructions on how to access their websites through VPNs or evade geographic blocks.
Fines and compliance standards
Utah’s Division of Consumer Protection can levy administrative fines of up to $2,500 per violation. Courts can also impose civil penalties of up to $2,500 per violation, along with other remedies.
The statute bars verification providers from retaining identifying information after access has been granted. Website operators that use verification methods meeting standards set by division rules are considered compliant with the law’s age-verification requirements.
Nym says the measure restricts speech about privacy tools
Privacy company Nym argued on X that SB 73 goes beyond enforcement by limiting what covered websites can say about VPNs when those tools are used to bypass age checks.
The company wrote: 「The law restricts speech about a privacy tool. That is a First Amendment question the courts have not answered yet.」
Utah joins a wider regulatory push around VPN workarounds
SB 73 is the latest move by regulators trying to use VPN restrictions to enforce platform bans and stop users from bypassing age checks.
In September 2024, Brazilian authorities began investigating users suspected of using VPNs to evade the country’s temporary ban on X, with potential fines nearing $9,000 per day.
In July 2025, demand for VPN services in the U.K. jumped by more than 6,000% after age checks took effect.
Nym CEO and co-founder Harry Halpin told Decrypt at the time: 「The reason there's an increase is because the UK passed an ill-thought-out Online Safety Bill.」
Nym, which runs a decentralized VPN service, saw its NYM token rise 12% during that surge, one day after the launch of its iOS app.
In February, France considered restricting minors’ use of VPNs to bypass age controls, though officials stopped short of proposing an outright ban.