A new Utah law has done something no other US state law has attempted before: it explicitly targets VPN use itself, not just the websites VPNs are used to access, marking a genuinely significant shift in how state governments are approaching online privacy tools.
What Utah’s Law Actually Does
Utah’s Senate Bill 73, formally called the Online Age Verification Amendments, became the first US law to explicitly target VPN use in an age-verification context when it took effect on September 3, 2026, according to Gizmodo’s coverage of the law taking effect. The law was signed by Governor Spencer Cox on March 19, 2026, passing the state Senate 22-2 and the House 66-1, targeting commercial websites where more than one-third of content is considered harmful to minors.
How the Law Specifically Treats VPN Use
The law’s most novel provision addresses location masking directly: users are legally treated as being physically located in Utah based on their real-world location, regardless of whether they use a VPN or proxy to mask their apparent location, according to a detailed breakdown of the law’s provisions. In practical terms, this means using a VPN to appear as though you’re located outside Utah does not exempt you from the state’s age-verification requirements — a genuinely different legal approach than simply regulating website behavior.
The Court Fight That Delayed Enforcement
The law was originally scheduled to take effect May 6, 2026, but Aylo, the parent company of Pornhub, challenged it in court, resulting in a temporary pause on enforcement. That injunction expired, and the law’s VPN-related provisions ultimately went into effect September 3, 2026, following months of legal wrangling between the state and the affected industry.
Why Privacy Advocates Are Genuinely Concerned
According to the Electronic Frontier Foundation’s analysis, other states, including Wisconsin, previously removed similar VPN-targeting provisions from their own age-verification bills due to constitutional and technical concerns. Utah proceeding anyway represents a meaningful escalation, since it establishes a legal precedent other states could follow, and the EFF has specifically flagged this as a real threat to digital privacy rights more broadly, not just to the specific websites the law targets.
What Websites Are Actually Required to Do
Covered websites cannot provide instructions on using VPNs to bypass age checks, and cannot encourage users to avoid location-based restrictions in any way. This creates a genuinely awkward incentive: platforms may simply avoid discussing VPNs at all in their own help documentation or marketing, purely to reduce their own legal exposure, rather than directly engaging with how users might otherwise navigate the requirement. This same tension between platform terms and what users actually try to do shows up in how downloading YouTube videos sits in a genuine legal gray area — platforms increasingly restrict discussing workarounds even when the underlying legal question is genuinely unsettled.
What This Means If You Live in Utah
If you’re physically located in Utah, using a VPN to mask your location no longer provides a legal way around age-verification requirements on covered websites, since the law explicitly bases compliance on your real-world physical location rather than your apparent, VPN-masked location. This is a meaningfully different enforcement model than most people assume VPNs provide protection against.
Why This Matters Even Outside Utah
Legal precedents set in one state frequently influence similar legislation elsewhere, and privacy advocates are watching whether other states adopt similar VPN-specific provisions in their own age-verification laws going forward. This connects to a broader pattern of digital privacy and platform regulation we’ve covered in AI governance and guardrails becoming an active enforcement category in 2026 — regulatory frameworks around digital technology are moving from theoretical policy discussions into active, enforced law considerably faster than they used to.
What to Actually Watch Going Forward
Whether other states introduce similar VPN-specific provisions, and whether further legal challenges succeed in narrowing or overturning Utah’s specific approach, will likely shape how this precedent plays out nationally over the next year or two. This same [CLIENT LINK PLACEHOLDER] pattern of state-level tech regulation moving faster than federal frameworks is something we’ve tracked across other digital policy areas too, not just age verification specifically.
Frequently Asked Questions
Does Utah’s law ban VPN use entirely?
No — the law doesn’t ban VPN use itself. It specifically prevents VPN use from exempting someone physically located in Utah from age-verification requirements on covered websites, and restricts those websites from promoting VPN use as a workaround.
Could other states pass similar VPN-targeting laws?
It’s genuinely possible — privacy advocates specifically flag Utah’s law as a precedent other states could reference, though some states have previously removed similar provisions from their own bills over constitutional and technical concerns.
The Bottom Line
Utah’s VPN-targeting law represents a genuinely new approach to online age verification, one that treats a user’s real-world location as legally binding regardless of VPN use, and privacy advocates are watching closely to see whether this specific model spreads to other states or faces further legal challenges that could narrow its reach.