Utah Becomes First State to Target VPNs in Age-Verification Crackdown

In brief

• Covered websites must verify Utah visitors’ ages even when VPNs conceal their location.
• Verification providers cannot retain identifying information after granting access.
• Operators face penalties for violations and cannot provide VPN instructions to help users bypass age checks.

Utah is testing new ground in the digital rights battle, becoming the first state to directly target VPN use for age verification.

The state will now require websites that host adult material to verify visitors’ ages even when VPNs hide their location, putting operators on the hook for determining whether users are physically inside the state.

Utah’s SB 73 requires commercial websites that “knowingly and intentionally publish or distribute material harmful to minors” to verify Utah visitors’ ages when that material exceeds one-third of their content—even if visitors conceal their location with VPNs or proxies.

“A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements,” the bill said.

Under the law, visitors physically in Utah count as Utah users regardless of whether they use a virtual private network, proxy server, or another tool to disguise their location. VPNs route traffic through remote servers, concealing the IP address a website would otherwise see.