Utah has expanded its age verification requirements for content targeted at minors to include VPN usage, becoming the first state to directly incorporate such circumvention methods into state law. Under the new rules, if a website contains a significant amount of adult content, operators must still verify the user’s age—even if the user is hiding their location via a VPN or proxy—by determining whether they are physically located in Utah.
SB 73 restricts VPNs.
Under SB 73, commercial websites that knowingly and intentionally post content harmful to minors, where such content constitutes more than one-third of the website’s total content, must verify the age of visitors located in Utah. The law also explicitly states that whether a user employs a VPN, proxy server, or other tools to conceal their location does not alter their classification as a “Utah user.”
This means that websites cannot process access requests based solely on surface-level IP information; they must assume greater responsibility for accurately identifying the actual geographic location. For operators, this increases both compliance complexity and legal risk.
The website must not provide guidance on how to circumvent restrictions.
The new law also prohibits related websites from assisting users in bypassing age verification, including providing instructions on how to use a VPN to access the site or how to circumvent geographic restrictions. State consumer protection agencies may impose administrative fines of up to $2,500 per violation, and courts may impose civil penalties of the same amount, along with additional remedies.
- Administrative fine: Up to $2,500 per violation
- Civil penalty: The court may impose up to $2,500 per violation.
- Data requirement: Do not retain any personally identifiable information after verification is complete.
Verifiable service providers are also subject to these constraints. Legally, verification service providers must not retain personally identifiable information after granting access. If the operator uses a verification method compliant with state regulatory rules, it will be considered to satisfy the age verification requirements.
Privacy group raises constitutional challenges
Privacy company Nym stated on X that SB 73 not only restricts access methods but also impacts public expression regarding privacy tools. The company argues that prohibiting websites from publishing instructions on using VPNs to bypass age verification could raise First Amendment concerns under the U.S. Constitution.
Similar debates have previously arisen in multiple countries. In September 2024, Brazil investigated users who used VPNs to bypass temporary restrictions on X; in July 2025, demand for VPNs in the UK surged following the implementation of age verification measures. France also discussed restricting minors' use of VPNs to circumvent age controls earlier this year, but did not pursue a comprehensive ban.