Utah VPN Age Checks Explained
Is SB 73 really a VPN ban, or something more complicated?
Utah's SB 73 has been described by some headlines as a VPN crackdown, but the details are more specific. The law does not make normal VPN use illegal. Instead, it says people physically in Utah count as Utah users even if they use a VPN, proxy or another tool to hide their location, and it restricts covered adult-content websites from helping users bypass age checks.
Quick Verdict
Not a blanket VPN ban, but still a serious privacy issue
The safest way to describe Utah SB 73 is this: it is an age-verification law that indirectly targets VPN-based location masking. It is aimed at commercial entities that publish or distribute a substantial amount of material considered harmful to minors, not at ordinary people using a VPN for banking, public Wi-Fi, remote work or general privacy.
What Utah SB 73 Actually Does
SB 73 updates Utah's rules for commercial entities that knowingly and intentionally publish or distribute material harmful to minors on websites where that material makes up a substantial portion of the site. In the bill, substantial portion means more than one-third of the total material on a website.
For covered sites, the law requires reasonable age-verification methods before an individual can access the material. The bill lists examples such as a digitised identification card, an independent third-party age-verification service, transactional-data methods, or processes later established by Utah's Division of Consumer Protection.
The law also says the commercial entity or third party performing the age check must not retain identifying information after access has been granted. That is an important privacy safeguard, although critics still worry about how age checks work in practice.
Is This Really a VPN Ban?
No. Calling it a simple VPN ban is misleading. SB 73 does not say that Utah residents are banned from installing, subscribing to, or using a VPN. It also does not ban VPNs for work, cybersecurity, travel, public Wi-Fi, journalism or private browsing generally.
The VPN controversy comes from two narrower provisions. First, an individual is treated as accessing a website from Utah if the person is actually in Utah, even if they use a VPN, proxy server or another method to make it appear that they are outside the state. Second, covered websites may not facilitate or encourage the use of a VPN, proxy or similar method to circumvent age verification.
| Claim | Better Reading | Why It Matters |
|---|---|---|
| Utah banned VPNs | Too broad | The law targets age-verification circumvention on covered sites, not general VPN ownership or ordinary VPN use. |
| Utah users can ignore age checks by using a VPN | Wrong under the law | The bill says a person physically in Utah still counts as accessing from Utah even when using location-masking tools. |
| Websites may react by blocking VPN traffic | Possible | Some platforms may choose broad blocking or wider age checks to reduce legal risk. |
| Normal privacy VPN use remains lawful | Generally yes | Using a VPN for security, work or private browsing is not the same as bypassing a legally required age gate. |
Who Is Most Affected?
The direct legal obligations sit mainly with covered commercial websites and age-verification providers. Users are affected indirectly because websites may change access rules, block some traffic, or ask for more identity checks to reduce their own risk.
- Covered adult-content websites: may need to verify age for Utah users and avoid publishing bypass instructions.
- Age-verification providers: may need to meet Utah standards around accuracy, data security and disposal of verification data.
- VPN users in Utah: may find that some websites no longer accept VPN traffic or require age checks despite a masked IP location.
- Users outside Utah: may be affected if websites cannot reliably tell where visitors are located and decide to apply stricter checks more widely.
For most everyday VPN users, the key practical risk is not being fined for using a VPN. It is losing access to some websites or being pushed into broader age-verification flows.
Why Privacy Groups Are Concerned
The policy goal is child protection, which is a legitimate concern for lawmakers and parents. The dispute is about method. Digital-rights groups argue that age-verification mandates can make adults hand over sensitive personal information, and that pushing platforms to police VPN use can weaken lawful privacy tools.
The technical problem is also real. Websites can try to detect data-centre VPN IP addresses, known proxy ranges or unusual traffic patterns, but there is no perfect global VPN blocklist. VPN providers can add addresses, users can move between services, and residential proxies can make traffic look like ordinary home broadband.
The core trade-off
Utah wants websites to stop minors from bypassing age gates. Critics say the practical result may be broader identity checks for everyone, wider VPN blocking, and more pressure on anonymous browsing. Both concerns should be considered: protecting children online matters, but privacy and security tools also have legitimate everyday uses.
What Websites May Do Next
Because the law creates risk for covered websites, platforms may respond in different ways. The exact response will depend on the site's size, risk tolerance, legal advice and technical systems.
| Possible Response | Benefit for Website | Downside for Users |
|---|---|---|
| Age-check only likely Utah users | More targeted and less disruptive | VPN or proxy users may still be hard to classify accurately. |
| Block Utah traffic | Reduces compliance burden in Utah | Adults in Utah may lose access entirely. |
| Block known VPN IPs | May reduce obvious location masking | Can block lawful privacy users and still miss residential proxies. |
| Age-check all visitors | Simpler legal posture across regions | Expands identity checks far beyond Utah. |
| Wait for court clarity | Avoids overreaction while enforcement is paused | Leaves users and publishers with uncertainty. |
What VPN Users Should Know
If you use a VPN in Utah, do not assume that a changed IP location removes every legal or website rule that applies to where you physically are. A VPN can protect your connection and hide your real IP from websites, but it does not change your actual location for legal purposes.
- Do not treat this as legal advice: laws and court rulings can change, so check official sources or a qualified lawyer for compliance questions.
- Understand the difference between privacy and circumvention: using a VPN for security is different from using it to bypass an age gate.
- Be cautious with ID checks: look for clear privacy notices, data-retention limits and trusted verification providers before sharing sensitive information.
- Expect inconsistent website behaviour: some sites may block VPNs, some may ask for verification, and others may wait for further legal clarity.
- Keep wider tracking in mind: cookies, account logins, payment details and browser fingerprints can identify you even when your IP address changes.
A VPN can still be useful for encrypted public Wi-Fi and IP privacy. Just remember that it does not make age-verification rules disappear.
Utah SB 73 Timeline
FAQs
Did Utah ban VPNs?
No. SB 73 does not ban ordinary VPN use. It says Utah users are still treated as Utah users when accessing covered websites, even if they use a VPN or proxy to disguise location.
Can websites tell whether I am using a VPN?
Sometimes, but not perfectly. Websites may use VPN IP databases and traffic signals, but VPN IPs change and residential proxies are especially difficult to identify reliably.
Does this apply to every website?
No. The key provisions apply to commercial entities that knowingly and intentionally publish or distribute material harmful to minors on websites where that material makes up a substantial portion of the site.
Is enforcement active right now?
As of this article's update, EFF says Utah agreed not to enforce the VPN provisions until 3rd September 2026 after a court challenge by Aylo. Readers should check for later court or state updates before relying on that status.
Can a VPN protect privacy during age checks?
A VPN can hide your real IP address from a website, but it cannot stop an age-verification provider from collecting information you directly submit. Privacy depends on the verification method, retention rules, provider security and whether you are logged into other accounts.
