Summary
- Websites must confirm the ages of Utah visitors even if they use VPNs.
- Verification services are prohibited from storing personal data after access is granted.
- Operators risk fines for non-compliance and cannot assist users in bypassing age checks.
Utah has taken a significant step in the ongoing debate over digital rights by becoming the first state to specifically address the use of VPNs in age verification processes.
Under new regulations, websites that host adult content are mandated to verify the ages of their visitors, regardless of whether VPNs mask their physical location. This places the responsibility on website operators to ascertain if users are actually located within Utah.
Senate Bill 73 in Utah stipulates that commercial sites which knowingly distribute material harmful to minors must confirm the ages of Utah users when such content constitutes more than one-third of their offerings, even if users attempt to hide their location using VPNs or proxies.
The legislation states, "A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements."
According to this law, individuals physically present in Utah are considered Utah users, irrespective of any VPN or proxy usage that may obscure their actual location. VPNs typically reroute internet traffic through different servers, disguising the user's IP address.
The law also prohibits operators from aiding visitors in evading age verification checks by providing guidance on using VPNs or circumventing geographic restrictions.
🇺🇸 Utah's SB 73 prohibits websites from giving instructions on how to use a VPN to bypass age verification.
Sharing information regarding VPN functionality is now illegal in Utah when it pertains to age verification.
This legislation limits discussion surrounding a privacy tool.
That is a First… pic.twitter.com/1cOar6zX36
— Nym (@nym) September 3, 2026
The Division of Consumer Protection holds the authority to impose fines of up to $2,500 for each violation. Courts may also levy civil penalties reaching $2,500 per infraction, in addition to other possible remedies.
Furthermore, the law mandates that verification providers must not keep any identifying information once access has been granted. Operators adhering to verification methods that comply with standards set by the division are considered to meet the age verification criteria.
Nym, a privacy-focused company, voiced concerns on X about how SB 73's restriction on providing VPN guidance for evading age checks infringes on the right to discuss privacy tools. They stated, "The law restricts speech about a privacy tool. That is a First Amendment question the courts have not answered yet."
This legislation is part of a broader trend among regulators aiming to restrict VPN usage to enforce platform restrictions and prevent users from circumventing age verification.
In September 2024, Brazilian authorities began investigating individuals suspected of using VPNs to bypass a temporary ban on X, with potential fines nearing $9,000 daily.
In July 2025, there was a dramatic surge of over 6,000% in VPN demand in the UK as new age checks were implemented.
According to Nym CEO Harry Halpin, the surge in demand was due to the UK passing a poorly conceived Online Safety Bill. Following this increase, Nym's decentralized VPN service saw a 12% rise in its NYM token shortly after the launch of its iOS application.
Additionally, in February, France considered limiting minors' use of VPNs to avoid age restrictions, although officials dismissed the idea of an outright ban.