Utah is set to become the first U.S. state to enforce a law that directly targets VPNs for age verification, raising significant privacy concerns. On May 6, 2026, the Online Age Verification Amendments, known as Senate Bill 73, will take effect, fundamentally changing how adult websites operate in the state.
The law mandates that companies must ensure users are of legal age, even if they access sites through a VPN. This has spurred worries about digital privacy—users may face invasive identity checks or even blocks on their VPN usage. The Electronic Frontier Foundation has voiced strong opposition, stating that this measure could subject millions to unnecessary scrutiny.
Signed into law by Governor Spencer Cox on March 19, 2026, this legislation reflects a growing trend among states to regulate online content more strictly. Utah’s approach is particularly noteworthy because it not only targets age verification but also creates what some have called a “liability trap” for websites unable to verify users’ locations accurately.
Key components of the law include:
- The prohibition of adult websites from providing instructions on how to use a VPN to bypass age checks.
- A liability clause that holds companies accountable even when users employ VPNs.
- A potential 2% tax on revenues from online adult content as part of compliance measures.
This initiative raises significant First Amendment concerns. Critics argue it could infringe upon free speech rights by limiting access to information and services based on arbitrary location restrictions. NordVPN has highlighted the technical challenges involved—”Blocking all known VPN and proxy IPs is a technical whack-a-mole that likely no company can win,” they stated.
As Utah moves forward with this unprecedented legislation, the effectiveness of enforcing such regulations remains uncertain. Companies are left grappling with how to comply without violating user privacy. The broader implications for digital rights and freedoms are profound, suggesting that this law may serve as a blueprint for other states contemplating similar measures.
Ultimately, Utah’s actions signal a critical moment in the ongoing battle between online privacy and government regulation. The landscape of digital interaction may be forever altered as these laws evolve and expand across the United States.
