Utah is about to make history in the worst possible way. Next week, on May 6, 2026, the state will become the first in the nation to target VPN usage for bypassing age verification requirements. The move marks a significant escalation in the ongoing battle between digital privacy advocates and lawmakers pushing for stricter online age controls.
For years, the pattern has been predictable: states pass clunky age verification laws, VPN usage surges as people protect their privacy, and lawmakers scratch their heads wondering why compliance remains low. Instead of questioning whether mass surveillance and age gates might be unpopular for good reason, Utah has decided VPNs are the real problem.
What the new law actually does
The legislation, formally called the “Online Age Verification Amendments” (Senate Bill 73), was signed by Governor Spencer Cox on March 19, 2026. While most of the bill deals with a 2% tax on online adult content revenues starting in October, the VPN provisions take effect this Wednesday.
The law changes the game in two key ways:
- Location-based liability: If you’re physically in Utah, you’re considered a Utah user regardless of VPN use. Websites must verify your age based on your actual location, not your apparent IP address.
- Information restrictions: Sites with substantial adult content can’t provide VPN instructions or help users bypass geographic restrictions.
The liability trap
Here’s where things get messy. The law creates what privacy advocates call a “liability trap.” Websites can’t reliably detect when someone is using a VPN from Utah, but they’re legally required to age-verify those users anyway.
This impossible requirement could force websites into two equally problematic solutions: block all known VPN IP addresses globally, or require age verification for every single visitor worldwide. Either option would affect millions of users who have nothing to do with Utah.
The technical reality makes compliance nearly impossible. VPN providers constantly add new IP addresses, and no comprehensive blocklist exists. Companies would be playing an endless game of whack-a-mole.
A “don’t ask, don’t tell” approach
Unlike more extreme proposals in other states, Utah’s law doesn’t explicitly ban VPN use. Instead, it creates a murky “don’t ask, don’t tell” enforcement mechanism. Websites only need to verify ages if they actually discover a user is physically in Utah and using a VPN.
This approach still raises serious First Amendment concerns. The law prevents platforms from sharing basic, truthful information about legal privacy tools with their users. That’s government censorship of factual information about legitimate technology.
Technical workarounds will emerge immediately
The internet has always routed around censorship, and Utah’s law won’t change that fundamental reality. If commercial VPNs become harder to use, motivated users will simply switch to:
- Non-commercial proxy servers
- Private tunnels through cloud services like AWS
- Residential proxies that look identical to regular home internet traffic
These workarounds will appear within hours of the law taking effect. Meanwhile, the real casualties will be businesses, journalists, and abuse survivors who depend on commercial VPNs for essential data security.
A tech-savvy teenager won’t be stopped by this law. But regular Utah residents who use VPNs to protect their data from brokers and malicious actors will face new barriers and privacy risks.
Setting a dangerous precedent
Utah’s approach represents a troubling shift from failed age verification mandates to direct attacks on privacy tools themselves. As the Cato Institute notes, when internet policies can be easily circumvented by common privacy technology, maybe the policy is the problem.
The precedent extends beyond state borders. International regulators are watching closely. The UK Children’s Commissioner has called VPNs a “loophole that needs closing,” while France’s Minister Delegate for Digital Affairs says VPNs are “the next topic on my list” after banning social media for kids under 15.
This law represents lawmakers who don’t understand the difference between security tools and “loopholes” writing rules for critical internet infrastructure. The result won’t be a safer internet – just a less private one. As Utah enters this uncharted territory next week, the implications for digital privacy rights across the country remain deeply concerning.