Utah has enacted SB 73, the first state law directly targeting VPN use for age verification, described as the Utah SB 73 VPN age-verification law. SB 73 requires commercial websites that publish material harmful to minors to verify the age of visitors physically located in Utah and counts such visitors as Utah users regardless of whether they use a VPN, proxy, or other means to disguise their location. The law bars website operators from facilitating bypasses of age checks, including publishing instructions on using VPNs or proxies to evade verification.
SB 73 requires commercial websites that publish material harmful to minors to verify the age of Utah visitors when that material exceeds one-third of their content. The law counts visitors physically located in Utah as Utah users regardless of whether they use a VPN, proxy, or other means to disguise their location. Utah is the first state to directly target VPN use for age verification. The statute includes these provisions.
Operators are prohibited from facilitating or encouraging the use of virtual private networks, proxy servers, or other means to circumvent age verification, including by providing instructions to access websites through VPNs or evade geographic blocks. SB 73 bans websites from publishing instructions on how to use a VPN to bypass age verification, and it makes publishing information about how VPNs work illegal when related to age verification. The statute prohibits verification providers from retaining identifying information after granting access. Operators that use verification methods meeting standards established by division rules are deemed compliant. Violations can result in administrative fines and civil penalties, each up to $2,500 per violation.
This section presents the statute’s stated mechanisms and compliance requirements as provided in the material above. No interpretation or additional information beyond the statute’s provisions is included here.
In September 2024, Brazilian authorities began investigating users suspected of using VPNs to evade a temporary ban on the X platform. In July 2025, UK VPN demand surged more than 6,000% when age checks took effect. These incidents are cited as examples of regulatory actions and market responses outside Utah.
SB 73 is presented as part of regulators’ ongoing actions targeting VPNs to enforce platform bans and prevent age-check circumvention. The statute adds state-level restrictions on website operators. It is positioned alongside international actions that address VPN use to bypass platform or age restrictions.
Nym argued that SB 73’s prohibition on publishing instructions about VPN use restricts speech about a privacy tool and described the issue as a First Amendment question. Privacy advocates have raised First Amendment concerns about the prohibition on VPN instructions. The courts have not yet answered those First Amendment questions.
This section summarizes related regulatory actions, market responses, and asserted constitutional concerns connected to VPN use and age verification. It records the Brazilian investigation and the UK demand surge as examples of actions outside Utah. It also records that courts have not yet resolved the First Amendment questions raised.
Utah SB 73 targets VPN and proxy use to enforce age verification, requiring commercial websites that publish a substantial portion of material harmful to minors to verify Utah visitors and counting anyone physically located in Utah as a Utah user regardless of efforts to mask location. The law bans website operators from publishing instructions to bypass age checks, including guidance on using VPNs or evading geographic blocks, and prohibits verification providers from retaining identifying information after granting access. Noncompliance can result in administrative fines and civil penalties of up to $2,500 per violation, and privacy advocates have raised First Amendment concerns that courts have not yet resolved.
