Utah Enacts VPN Rule Tied to Age Verification

Utah targets VPNs to bypass age gates, effective May 6. The measure, Senate Bill 73, was signed by Governor Spencer Cox on March 19, 2026 and also includes a 2% tax on revenues from online adult content that is due to take effect in October. EFF

Key among the provisions are the VPN rules. The law explicitly addresses VPN usage in Section 14, amending Section 78B-3-1002. It regulates access based on physical location: an individual is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN, proxy, or other tools. Utah is positioned as the first state to target VPN usage to avoid age verification gates. EFF

Digital rights advocates warn that this approach threatens privacy. Policy documents show that mass surveillance and age gates are already controversial, and Utah's move could push residents toward greater privacy tradeoffs as they seek to mask their location. The resulting tension between protecting minors and preserving digital privacy is at the center of the debate. EFF

Industry observers say platforms will feel the squeeze. Compliance guidance states that online services with Utah users may need to rethink how they perform geolocation checks and how they attribute user location for access decisions, given the physical presence rule. The practical effect is a rethink of how Utah residents are identified online, even when VPNs are in play. EFF

Looking ahead, the law could face legal challenges and possible amendments as jurisdictions test privacy protections against age-verification controls. Legislative text confirms that Utah is willing to push the boundaries on location based access and funding mechanisms tied to online content, a combination that will likely invite courtroom and regulatory scrutiny. EFF