Someone in Salt Lake City routes their connection through a German VPN endpoint. Under Utah’s SB 73, they’re still a Utah user. Doesn’t matter where the server sits. Physical presence is what counts. The law’s core VPN provisions became enforceable September 3 — though the statutory effective date was May 6 — making Utah the first U.S. state to explicitly write VPN use into an age-verification statute. Using a VPN remains fully legal. What changed is who gets held responsible when residents use one to access certain content.
Here’s what SB 73 actually does:
- Targets commercial sites where more than one-third of content is deemed harmful to minors, requiring “reasonable age verification” for Utah users
- Defines a Utah user by physical presence — not IP address, not VPN endpoint location
- Bans covered sites from publishing instructions on bypassing age checks via VPN or proxy
- Authorizes fines up to $2,500 per violation; individual Utah residents can also sue
- Aylo (Pornhub’s parent) secured a non-enforcement agreement through at least September 17 while a federal court weighs a preliminary injunction
The technical bind this creates for websites — not VPN providers — is genuinely brutal. Sites must either block all suspected VPN traffic using IP lists that are incomplete and constantly changing, or age-verify every global visitor to avoid missing a Utah user behind a foreign endpoint. The Electronic Frontier Foundation calls this “impossible by design.” It’s regulatory whack-a-mole: users route through new endpoints while platforms face pressure to over-collect ID data, catching legitimate privacy users as collateral damage — a dynamic that mirrors broader concerns about tracking users without meaningful consent.
The Industry Isn’t Budging
Major VPN providers are standing firm, insisting compliance obligations fall on content platforms — not the tools users rely on for everyday security.
NordVPN, AdGuard VPN, and Surfshark have all confirmed zero service changes for Utah users. NordVPN’s privacy advocate Laura Tyrylyte stated the law’s obligations “fall on websites that host content deemed harmful to minors, not on VPN providers.” Utah lawmakers, for their part, argue strong VPN-targeting provisions are necessary to meaningfully limit minors’ access to harmful content online — a reminder that the pressure driving SB 73 reflects genuine child-safety concerns, not unlike the debate around AI age laws and their unintended consequences.
Context matters here. Utah’s 2023 SB 287 required adult site age verification — Pornhub responded by blocking all Utah traffic entirely. SB 73 is the state doubling down, adding VPN-specific provisions and its own enforcement authority through the Division of Consumer Protection. The UK’s Online Safety Act and EU age-assurance rules are trending similarly, but none have codified VPN use this explicitly. Utah is the first domino.
If SB 73 survives federal court challenge, other states could adopt the same template — and platforms may start blocking VPN traffic as standard compliance practice. The real question was never about porn. It’s whether VPNs remain neutral infrastructure, or get reclassified as the problem.
