Covered websites must verify Utah visitors’ ages even when VPNs conceal their location.
Verification providers cannot retain identifying information after granting access.
Operators face penalties for violations and cannot provide VPN instructions to help users bypass age checks.
Utah is testing new ground in the digital rights battle, becoming the first state to directly target VPN use for age verification.
The state will now require websites that host adult material to verify visitors’ ages even when VPNs hide their location, putting operators on the hook for determining whether users are physically inside the state.
Utah’s SB 73 requires commercial websites that “knowingly and intentionally publish or distribute material harmful to minors” to verify Utah visitors’ ages when that material exceeds one-third of their content—even if visitors conceal their location with VPNs or proxies.
“A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements,” the bill said.
Under the law, visitors physically in Utah count as Utah users regardless of whether they use a virtual private network, proxy server, or another tool to disguise their location. VPNs route traffic through remote servers, concealing the IP address a website would otherwise see.
The bill also restricts operators from helping visitors bypass age checks, including by providing instructions for accessing their websites through VPNs or evading geographic blocks.
🇺🇸 Utah’s SB 73 bans websites from publishing instructions on how to use a VPN to bypass age verification.
Publishing information about how VPNs work is now illegal in Utah if it relates to age verification.
The Division of Consumer Protection can impose administrative fines of up to $2,500 per violation. Courts can impose civil penalties of up to $2,500 per violation, alongside other remedies.
The statute also prohibits verification providers from retaining identifying information after granting access. Operators using verification methods that meet standards established by division rules are deemed compliant with the age-verification requirements.
Privacy company Nym argued on X that SB 73’s prohibition on covered websites providing VPN instructions to bypass age checks restricts speech about privacy tools.
“The law restricts speech about a privacy tool,” the company wrote. “That is a First Amendment question the courts have not answered yet.”
SB 73 is the latest action by regulators targeting VPNs both to enforce platform bans and to stop users bypassing age checks.
In September 2024, Brazilian authorities began investigating users suspected of using VPNs to evade the country’s temporary ban on X, with potential fines approaching $9,000 a day.
“The reason there’s an increase is because the UK passed an ill-thought-out Online Safety Bill,” Nym CEO and co-founder Harry Halpin told Decrypt at the time.
Nym, which operates a decentralized VPN service, saw its NYM token climb 12% during the surge, a day after launching its iOS app.
