Utah will become the first U.S. state to enforce a law targeting VPNs for age verification on May 6, 2026. This legislation raises significant privacy concerns and could impact millions of users.
The law, known as Senate Bill 73, aims to enforce age verification for adult websites. It specifically targets VPN usage, holding companies liable for verifying user ages even when VPNs obscure their locations.
As of March 19, 2026, Governor Spencer Cox signed the bill into law. The Electronic Frontier Foundation has voiced strong opposition, warning that it could lead to invasive identity checks for many users.
The law creates a liability trap for websites unable to detect VPN users’ actual locations. It prohibits adult websites from providing instructions on bypassing age checks with VPNs.
Critics argue this legislation threatens digital privacy rights and poses challenges to First Amendment protections regarding free speech. The law does not explicitly ban VPN use but effectively discourages it through potential liabilities.
NordVPN described the situation as a “technical whack-a-mole” that companies cannot win. They highlighted that blocking all known VPN and proxy IPs would be nearly impossible.
Utah’s actions reflect a broader trend among governments targeting VPNs as barriers to online content regulation. The effectiveness of this law in enforcing age verification remains unclear.
The next steps in this legal landscape will unfold as the enforcement date approaches in May 2026. Stakeholders are closely monitoring how websites will adapt without infringing on user privacy.
