TL;DR: On Wednesday, May 6, 2026, Utah becomes the first US state to make websites legally responsible for users who slip past age-verification gates with a VPN. Senate Bill 73 (the “Online Age Verification Amendments”) treats anyone physically inside Utah as a Utah user, regardless of what their IP address says. It also bars covered sites from publishing instructions on how to use a VPN to bypass age checks. The bill, sponsored by Sen. Calvin Musselman with Rep. Steve Eliason carrying it in the House, passed 22–2 in the Senate and 66–1 in the House before Gov. Spencer Cox signed it on March 19. The Electronic Frontier Foundation is calling it a First Amendment problem and a “technical whack-a-mole.” NordVPN is calling it a “liability trap.” Both are right.
What Changes Wednesday
Half of America already requires you to upload a driver’s license or scan your face to look at certain websites. That’s old news. What’s new is what Utah just did with the part of the rulebook everyone else forgot to write.
Utah’s SB 73 doesn’t ban VPNs. It doesn’t require ISPs to block them. It doesn’t even require websites to detect every VPN user. It does something subtler and more dangerous: it tells websites that if a Utah resident is sitting in Salt Lake City running a VPN that makes them look like they’re in Amsterdam, the website is still on the hook for verifying their age as a Utah user [1].
The text from EFF’s legal analysis: “An individual is considered to be accessing the website from Utah if the individual is actually located in the state, regardless of whether the individual is using a virtual private network” [1].
That’s a small sentence with enormous consequences. Every other state with an age-verification law treats your IP as your location. Utah just decoupled them.
How the Mechanic Actually Works
Here’s the practical scenario. You’re in Provo. You fire up a VPN, pick a server in Germany, and visit a covered website. The site sees a German IP. Under any other state’s law, you’re a German user and there’s no Utah obligation. Under SB 73, you’re still a Utah user the moment the site has reason to believe you’re physically in the state.
How does a website figure that out? It doesn’t, reliably. That’s the trap.
EFF’s reading: websites “likely only have an obligation to ask for proof of age if they actually learn that a user is physically in Utah and using a VPN.” The words doing the work there are “actually learn.” Account info. Billing addresses. Payment metadata. A user volunteering “I’m in SLC.” Any of those flips a website from compliant to non-compliant retroactively [1].
So the safe play for any large platform is to age-gate everyone on a Utah-shaped IP envelope (meaning the surrounding states feel the spillover too) or just block all known VPN traffic. EFF calls that second option “a technical whack-a-mole that likely no company can win” [1]. New VPN endpoints come online by the hour. Residential proxies are cheap. The list of IPs to block is infinite and the false-positive rate hits paying customers who use VPNs for ordinary reasons.
The First Amendment Problem Hiding in Section Two
The IP-and-physical-location piece is the one getting the headlines. The other half of SB 73 is arguably worse and is getting less attention.
The bill prohibits covered websites (defined as commercial entities hosting a substantial portion of material harmful to minors) from facilitating, encouraging, or providing instructions on how to use a VPN to bypass age verification [1].
Read that twice. The state of Utah is telling private companies they can’t publish truthful, accurate information about a legal product. VPN services are legal. Using them is legal. Explaining how they work is legal. Utah just carved out a category of website where it isn’t.
That’s a content-based speech restriction on a lawful technology. EFF is direct about it: the law “prevents platforms from providing basic, truthful information about a lawful privacy tool to their users” [1]. That language is teed up for a First Amendment challenge the moment somebody finds a plaintiff with standing.
Who Pushed This Through
SB 73 wasn’t a squeaker. It was a steamroller.
- Introduced January 5, 2026 by Sen. Calvin Musselman (R) [2]
- House floor sponsor: Rep. Steve Eliason (R) [2]
- Passed Senate February 23, 2026: 22 yes, 2 no, 5 absent [2]
- Passed House March 4, 2026: 66 yes, 1 no, 8 absent [2]
- Signed by Gov. Spencer Cox on March 19, 2026 [1]
- Effective date: May 6, 2026 [1]
Three Republicans dissented across both chambers combined. Privacy advocates didn’t get a real fight in committee. The bill got marketed as child safety and got voted on as child safety, and the VPN-liability part (the part that’s actually new under American law) barely surfaced in the floor debates.
The VPN Industry Is Already on Record
NordVPN, the largest commercial VPN provider, called SB 73 a “liability trap” in public comments to TechRadar last week [3]. The company’s position is that the law sets up an “unresolvable compliance paradox”: websites can’t reliably detect VPN users, but the law makes them liable when they don’t.
EFF’s framing is harsher. From their April 30 analysis: “Blocking all known VPN and proxy IP addresses is a technical whack-a-mole that likely no company can win” [1].
Translation for everyone who isn’t a digital rights lawyer: the only way for a major platform to comply with confidence is to age-gate every connection that even smells like a VPN. That blast radius hits journalists protecting sources, abuse survivors hiding from stalkers, business travelers on hotel WiFi, employees on corporate networks, and ordinary people who just don’t want their ISP selling their browsing history.
Who Actually Gets Hurt
Utah’s legislature framed SB 73 as protecting kids from porn. The real footprint is bigger than that.
Domestic Abuse Survivors
VPNs hide your location from people who want to find you. When platforms start blocking VPN traffic to avoid Utah liability, survivors get pushed onto unprotected connections that leak their real IP to anyone watching.
Journalists and Sources
Source protection often runs through commercial VPNs and Tor. Make those tools second-class citizens at the platform level and confidential reporting gets harder, especially for state and local journalists working on stories the powerful don’t want told.
Remote Workers and Travelers
Corporate VPNs and personal VPNs blur together at the IP level. A nurse working remotely from a hotel room in Park City could trip the same compliance flag as someone trying to dodge an age gate.
LGBTQ+ Users in Hostile Households
Teenagers and adults using VPNs to access support resources without leaving a trail on their home network are exactly the kind of edge case lawmakers don’t talk about when they pitch “child safety” bills.
What Happens After Wednesday
Three things to watch starting May 6.
Compliance theater from large platforms. Expect at least a few sites to geofence Utah entirely rather than try to thread the VPN-liability needle. Pornhub already did exactly this when Texas, Louisiana, and Florida went online with their age-verification laws. The pattern repeats.
A First Amendment lawsuit. The content-restriction piece (the one that bans websites from explaining how a VPN works) is the most legally vulnerable part of the bill. The Free Speech Coalition has sued every state that has passed an age-verification law to date. Utah won’t be different. The novel question is whether a plaintiff can challenge just the speech-restriction provision without the whole law getting tied up.
Copycats in other states. Wisconsin tried to do something similar earlier this year and stripped the VPN-targeting language after backlash. Michigan’s pending bill goes further than Utah. With SB 73 in effect, every state legislature that wants to look tough on tech will have a working template.
What You Can Do
Keep Using a VPN
Utah’s law doesn’t make VPN use illegal for individuals. It pushes liability onto websites. You can still legally use a paid VPN to protect your traffic. If you’re in Utah, expect more friction at age-gated sites, not handcuffs.
Avoid “Free” VPNs
Free VPNs typically pay for themselves by selling your traffic. With age-verification regimes spreading, the temptation for a sketchy provider to sell location data to a compliance vendor goes up, and that ad-data market already feeds government tracking of 500 million phones. Pay the few dollars a month for a no-logs provider with a published audit.
Watch the Free Speech Coalition Docket
FSC has been the lead plaintiff in challenges to state age-verification laws. Track their filings if you want to see when SB 73 gets challenged in federal court.
Tell Your Legislator It’s Not Acceptable
The copycat phase is starting now. If your state is debating its own version, the time to push back is before the floor vote, not after the governor signs.
References
- Electronic Frontier Foundation: Utah’s New Law Targeting VPNs Goes Into Effect Next Week (April 30, 2026)
- FastDemocracy: Utah SB 73 Bill Tracking, 2026 Legislative Session
- TechRadar: A Liability Trap: NordVPN Slams Utah Age Verification Law Targeting VPN Users (April 2026)
- Tom’s Hardware: Utah First State to Hold Websites Liable for Users Who Mask Their Location with VPNs (May 2026)
- PC Gamer: A Utah Age Verification Law Targeting VPN Users Goes Into Effect This Week
- CyberInsider: Utah Becomes First US State to Require Age Verification for VPN Use
- Utah Legislature: SB 73 Online Age Verification Amendments (Bill Page)