Utah’s SB 73 targets VPN use in age-verification rules

Utah’s Senate Bill 73 (SB 73), formally known as the Online Age Verification Amendments, comes into effect on September 3 after an earlier court injunction temporarily paused its planned May rollout.

The law requires commercial websites hosting adult material to verify users’ ages. Anyone physically located in Utah is treated as a Utah user regardless of the IP address shown to a website. A person in Salt Lake City using a VPN server in Germany would therefore still fall under the law, while the website remains responsible for age verification.

Websites that fail to comply can face penalties of up to $2,500 per violation. They may also resort to intrusive tracking or block suspected VPN traffic. Adult websites are barred from publishing instructions on using a VPN to bypass Utah’s age gates.

Utah is the first US state to explicitly target VPN use in age-verification mandates, but the law’s enforcement status remains uncertain. Laura Tyrylyte of NordVPN said the legal challenge is ongoing and that September 3 should not be treated as a set enforcement date.

NordVPN and AdGuard VPN said SB 73 does not create direct compliance obligations for VPN providers and that they do not plan to change their services for Utah users. Surfshark’s Gytis Malinauskas said the law treats a core cybersecurity tool as a loophole. Everyday encryption remains legal in Utah.