Summary (tl;dr)

Utah's new law, Senate Bill 73, takes effect on May 6, 2026, making it the first U.S. state to explicitly hold websites liable if users physically located in Utah circumvent age verification requirements for "material harmful to minors" by using a Virtual Private Network (VPN). The law also prohibits these websites from providing instructions on how to use VPNs to bypass age checks.

Essential Background

Utah has been at the forefront of implementing age verification laws for online content. In 2023, Senate Bill 287 was passed, requiring adult content websites to verify users' ages. This law faced a legal challenge but was upheld by a federal judge. Additionally, Utah enacted the Social Media Regulation Act (SB 152 and HB 311) in 2023, aiming to protect minors by requiring age verification and parental consent for social media use, though its implementation has been delayed and is subject to potential repeal and amendment.

The Full Story

The current focus is on Utah's Senate Bill 73, officially known as the "Online Age Verification Amendments," which was signed into law by Governor Spencer Cox on March 19, 2026, and becomes effective on May 6, 2026. This legislation establishes that a user is considered to be accessing a website from Utah if they are physically present in the state, regardless of whether they use a VPN or proxy server to conceal their location. Crucially, the law mandates that commercial entities hosting "a substantial portion of material harmful to minors" must verify the ages of users in Utah and will be held liable if individuals bypass these checks, even with a VPN. Furthermore, these websites are prohibited from facilitating or encouraging the use of VPNs to bypass age gates, including providing instructions.

Why It Matters

The new law has drawn strong criticism from digital privacy advocates and VPN providers, who argue it creates an "unresolvable compliance paradox" and a "liability trap" for websites. They contend that reliably detecting a user's true physical location when they are using a VPN is technically impossible. Critics warn that the legal risks associated with SB 73 could force websites to either block all known VPN IP addresses or implement global age verification for all visitors, regardless of their location, leading to invasive identity checks for millions of users. This development raises significant concerns about digital privacy, internet anonymity, and sets a potentially dangerous precedent for online regulation.

Geographic Location

• Salt Lake City, Salt Lake County, Utah, United States (signing of Senate Bill 73 and other age verification laws)