Utah age verification crackdown targeting VPNs

Utah age verification crackdown targeting VPNs has made Utah the first state to directly target VPN use for age verification through SB 73, establishing age-verification requirements for commercial websites that publish material harmful to minors. The law requires verification of Utah visitors’ ages even when those visitors use VPNs or proxies, and it treats visitors physically located in Utah as Utah users regardless of VPN use. Administrative fines and civil penalties can reach up to $2,500 per violation, applying to covered commercial sites.

SB 73 requires commercial websites that knowingly and intentionally publish or distribute material harmful to minors to verify the ages of visitors located in Utah when such material exceeds one-third of the site’s content. The age-verification requirement applies regardless of whether visitors access the site using a virtual private network, proxy server, or similar means. Under the law, visitors who are physically located in Utah are treated as Utah users even if they are using a VPN or proxy. When the proportion of harmful material rises above the one-third threshold, the statute triggers the age-verification obligation for visitors treated as Utah users.

The statute prohibits operators from facilitating or encouraging methods to bypass age verification, including providing instructions on accessing sites through VPNs, proxies, or other means to evade geographic blocks. The prohibition covers publication of guidance, tools, or other assistance intended to enable circumvention of age checks. These restrictions apply to commercial entities operating websites that contain a substantial portion of material harmful to minors under the statute’s definition. The bill bars operator conduct that would help visitors circumvent the statute’s age-verification measures.

SB 73 requires verification providers not to retain identifying information after a visitor is granted access. Operators that use verification methods meeting standards established by rules from the Division of Consumer Protection are deemed compliant with the statute’s age-verification requirements. The division’s rules set the verification standards that determine whether an operator’s chosen method satisfies legal compliance. Those verification and retention provisions are specified components of the statute’s legal framework.

These provisions collectively define the statute’s requirements and restrictions for covered commercial websites. Compliance is tied to the verification standards set by the Division of Consumer Protection.

In September 2024, Brazilian authorities began investigating users suspected of using VPNs to evade the country’s temporary ban on X. The investigations focused on suspected use of virtual private networks to circumvent the temporary ban. The inquiries carried potential fines approaching $9,000 a day for those suspected.

In July 2025, UK VPN demand surged more than 6,000% as age checks took effect. The surge occurred in July 2025 when age checks were implemented. Reported demand increased by more than 6,000%.

Both examples involve VPN use in the context of online restrictions or age-verification measures. They summarize the reported Brazilian investigation from September 2024 and the reported UK demand surge from July 2025. No further details are included here.

Utah’s SB 73 establishes a regulatory approach that requires commercial websites with a substantial portion of material harmful to minors to verify the ages of visitors treated as Utah users and prohibits operators from facilitating methods to bypass those checks, including providing instructions about VPNs or proxies. The law also includes privacy-focused provisions that bar verification providers from retaining identifying information after granting access and provides compliance standards through rules from the Division of Consumer Protection. Privacy company Nym has objected that the prohibition on VPN instructions restricts speech about privacy tools and raises unresolved First Amendment questions.