- Utah to hold companies liable for failing to verify the age of users even if they use VPN
- Senate Bill 73 takes effect on May 6, 2026
- Digital Rights Group warns that targeting VPNs is a “technical whack-a-mole”
Utah lawmakers are enacting a controversial new law that privacy experts warn could fundamentally break the Internet’s architecture of anonymity.
Set to take effect on May 6, 2026, the state’s online age verification changes, formally known as Senate Bill 73, would require adult websites to enforce strict age checks on anyone physically located in Utah.
It is crucial that companies remain accountable even if a visitor uses a VPN service to spoof their geographic location.
This is the first time a US state will rule out legislation that directly targets the use of a VPN to circumvent legal age limits.
While a recent push in Wisconsin to ban VPNs was scrapped due to strong backlash, Utah’s legislation survived and is now drawing fierce criticism from civil rights groups and tech companies alike.
A complete misunderstanding of security
Under SB 73, signed by Governor Spencer Cox on March 19, 2026, a user is considered to be accessing a website from Utah if they are physically there, regardless of a proxy server or VPN that masks their IP address.
The law also targets information sharing. It prohibits commercial entities that host a “substantial amount of material harmful to minors” from providing instructions on how to use a VPN to bypass these controls.
While it stops short of an outright ban on using a VPN, the Electronic Frontier Foundation (EFF) warns that the mandate is built on a “don’t ask, don’t tell” form of enforcement.
The EFF also argues that preventing platforms from sharing basic, truthful information about a legal privacy tool raises massive constitutional concerns regarding free speech.
Backlash is also coming from the VPN industry. Back in March, NordVPN strongly condemned the bill, telling TechRadar that blocking all known VPN and proxy IPs is “technically impossible.”
Because no comprehensive block list exists, the EFF reiterated that the requirement is simply a “technical whack-a-mole that no company is likely to win.”
NordVPN claims the law creates an “unresolvable compliance paradox” for responsible operators. Instead of protecting minors, the company warned that the legislation “will simply penalize legitimate users who care about their privacy, globally.” Ultimately, NordVPN states, “It’s a liability trap.”
By effectively holding websites accountable for users’ actions that mask their locations, the legal risk could push platforms to introduce blanket age checks for all internet traffic. As the EFF notes, this would force ordinary citizens to hand over their data to brokers and third-party verification tools.
A global war on anonymity
Utah’s crackdown is not an isolated incident. Across the globe, lawmakers are increasingly treating VPNs not as critical security tools but as obstacles to online regulation.
In the UK, the government recently confirmed it can “age-restrict or restrict children’s VPN use” following a three-month consultation designed to “close loopholes that put children at risk.”
Ultimately, privacy experts are deeply concerned that this global push will normalize mass surveillance.
Andy Yen, chief executive of Proton, recently warned that “age verification, as currently proposed in country after country, would mean the death of online anonymity.”
