A Utah law requiring adult websites to verify users' ages - even when those users are hiding their location behind a VPN - is set to take effect on May 6, and the technical and civil liberties questions it raises have no clean answers. Known formally as SB 73, the Online Age Verification Amendments, the law is the first in the United States to explicitly target virtual private networks as a mechanism for circumventing age restrictions. Its consequences, experts warn, may be felt well outside Utah's borders.
What the Law Actually Requires - and Why That Creates a Problem
The core demand of SB 73 is straightforward: adult content platforms must confirm that any user accessing their services from within Utah is old enough to do so legally. The law goes further than prior age-gating statutes by specifying that verification applies "regardless of whether the individual is using a virtual private network." Adult websites are also prohibited from advising users on how to employ VPNs to access their content.
The intent is clear. A pattern has emerged in states that have passed earlier age verification laws: traffic to adult platforms declines sharply, then partially recovers as users - including, legislators argue, minors - adopt VPNs to appear as if they are browsing from elsewhere. Utah's law attempts to close that route.
The enforcement problem, however, is fundamental. A website cannot reliably detect whether a user masked by a VPN is physically located in Utah. IP addresses associated with VPN exit nodes typically point to data centers, not residential addresses, and they can be located anywhere in the world. There is no technical standard that allows a platform to peer behind a VPN connection and identify a user's true geography with any consistency. The law imposes a legal obligation that current internet infrastructure cannot consistently satisfy.
The Compliance Trap and Its Wider Consequences
Faced with legal exposure they cannot fully quantify, platforms have limited options. They could attempt to block all known VPN traffic - a crude measure that would affect the far larger population of VPN users who are adults, not in Utah, and using these tools for entirely lawful reasons. They could require age verification from every user globally, eliminating the geographic threshold altogether. Or they could simply refuse access to any connection they cannot confidently geolocate, which would create unpredictable access failures for users in many countries.
None of these responses are targeted. All of them expand the reach of the law well beyond Utah residents. The Electronic Frontier Foundation has warned that the law's ambiguity effectively pressures companies into conducting what it describes as invasive identity checks on people who have no legal obligation to submit to them. VPN provider NordVPN has characterized the law as technically unenforceable, arguing that compliance attempts could subject millions of ordinary users to unnecessary identity verification processes.
VPNs are not primarily tools of evasion. They are widely used to protect data on public Wi-Fi networks, to prevent tracking by advertisers and data brokers, to secure business communications, and to allow individuals in restrictive environments to access information freely. A regulatory environment hostile to VPN usage does not affect only those seeking to bypass content restrictions - it affects the broader ecosystem of private, secure internet access.
A Precedent in the Making
Some legal analysts suggest the law may settle into a de facto non-enforcement posture - a situation where platforms apply verification only when they are reasonably certain of a Utah-based user's location, and ignore the VPN provision when they cannot make that determination. This would reduce immediate disruption, but it would also mean the law functions inconsistently and fails to achieve its stated purpose.
What cannot be ignored, regardless of how strictly SB 73 is enforced, is the regulatory signal it sends. This is the first U.S. state law to treat VPN use itself as a compliance variable in the context of content access. If it survives legal challenge and other states adopt similar language, the cumulative effect on platform behavior could be significant. Websites frequently apply uniform global policies rather than maintaining separate access rules for each jurisdiction - partly for efficiency, partly to reduce legal risk. A wave of state-level laws with VPN provisions could push platforms toward universal age verification systems and reduced tolerance for anonymous or pseudonymous browsing.
The tension at the center of SB 73 is not unique to Utah. Governments around the world are struggling to reconcile the protection of minors online with the preservation of privacy rights and open access. The difficulty is that the internet was not designed with hard geographic boundaries, and retrofitting those boundaries onto its architecture is neither simple nor neutral in its effects. Utah's law is an attempt to solve a genuine problem - underage access to adult content - but the mechanism it has chosen puts pressure on infrastructure that serves purposes far broader than the one being regulated.
- SB 73 takes effect May 6 and explicitly covers VPN-masked users
- Platforms cannot reliably identify VPN users' physical locations
- Compliance may require blocking all VPN traffic or universal age verification
- The Electronic Frontier Foundation and NordVPN have both raised enforcement and privacy objections
- The law sets a precedent that could influence similar legislation in other states
Whether SB 73 achieves its goal of protecting minors remains to be seen. What is already evident is that it has set a course for internet policy that will require platforms, privacy advocates, and legislators to reckon with questions that have no easy technical resolution - and that will not stay contained within one state's jurisdiction.