- Utah will hold companies responsible for failing to verify users’ ages, even if they use VPNs
- Senate Bill 73 will take effect on May 6, 2026
- Digital rights group warns that targeting VPNs is a ‘technical coup’
Utah lawmakers are poised to enforce a controversial new law that privacy experts warn could fundamentally break the architecture of Internet anonymity.
The state’s Online Age Verification Amendments, formally known as Senate Bill 73, which go into effect on May 6, 2026, will require adult websites to apply strict age controls to anyone physically located in Utah.
Crucially, companies will still be liable even if a visitor uses a VPN service to spoof their geographic location.
This is the first time a US state will rule out legislation that directly targets the use of a VPN to bypass legally mandated age barriers.
While a recent effort in Wisconsin to ban VPNs was scrapped due to strong backlash, Utah’s legislation survived and is now drawing fierce criticism from both civil liberties groups and technology companies.
A complete misunderstanding of security.
Under SB 73, signed into law by Governor Spencer Cox on March 19, 2026, a user is considered accessing a website from Utah if they are physically there, regardless of whether any proxy or VPN servers mask their IP address.
The law also aims at the exchange of information. It prohibits commercial entities that host a “substantial amount of material harmful to minors” from providing instructions on how to use a VPN to bypass these controls.
While stopping short of an outright ban on VPN use, the Electronic Frontier Foundation (EFF) warns that the mandate is based on a “don’t ask, don’t tell” style of enforcement.
The EFF also maintains that preventing platforms from sharing basic and truthful information about a legal privacy tool raises enormous constitutional concerns regarding freedom of expression.
The backlash is also coming from the VPN industry. In March, NordVPN strongly condemned the bill, telling TechRadar that blocking all known VPN and proxy IPs is “technically impossible.”
Because there is no complete block list, the EFF echoed that the requirement is simply a “technical blow that no company is likely to win.”
NordVPN maintains that the law creates an “irresolvable compliance paradox” for responsible operators. Instead of protecting minors, the company warned that the legislation “will simply punish legal users who care about their privacy, globally.” Ultimately, NordVPN claims, “It’s a liability trap.”
By effectively holding websites accountable for users’ actions that mask their location, legal risk may prompt platforms to adopt blanket age controls for all internet traffic. As the EFF points out, this would force ordinary citizens to hand over their data to intermediaries and third-party verification tools.
A global war against anonymity
The Utah crackdown is not an isolated incident. Around the world, lawmakers are increasingly treating VPNs not as critical security tools, but as roadblocks to online regulation.
In the UK, the government recently confirmed it may “age restrict or limit children’s use of VPNs” following a three-month consultation designed to “close loopholes that put children at risk.”
Ultimately, privacy experts are deeply concerned that this global push will normalize mass surveillance.
Proton CEO Andy Yen recently warned that “age verification as currently proposed in country after country would mean the death of online anonymity.”
