Utah becomes first U.S. state to require age checks even for VPN-masked visitors
Utah has become the first U.S. state to directly target VPN use in age-verification enforcement, expanding compliance duties for websites that host adult material. Under SB 73, commercial sites that knowingly publish or distribute material harmful to minors must verify the age of Utah visitors when that material makes up more than one-third of their content, even if those users hide their location with VPNs or proxy servers. The law also bars operators from helping users get around the checks, including by offering instructions on how to use VPNs or bypass geoblocks. The measure gives Utah’s Division of Consumer Protection authority to issue administrative fines of up to $2,500 per violation, while courts can impose civil penalties of the same amount and grant other remedies. At the same time, verification providers are barred from retaining identifying data after access is granted. Privacy firm Nym said the law raises a speech issue because it restricts what covered websites can say about privacy tools. The company argued on X that courts have not yet resolved whether such a restriction conflicts with the First Amendment. The Utah law comes as regulators in Brazil, the U.K., and France have also moved to limit VPN-based workarounds tied to platform bans and age-control systems.








