Utah has become the first U.S. state to directly address VPN use in an online age-verification law. The new rule, called Senate Bill 73 or SB 73, says adult-content websites must treat people physically located in Utah as Utah users even if they use a VPN or proxy that makes them appear to be somewhere else.
The law has caused debate because it deals with privacy, online safety, adult content, and the limits of what websites can realistically know about a visitor’s location. It has also led to confusion: Utah has not banned VPNs, and ordinary people are not automatically fined just for using one. Instead, the main legal responsibility falls on certain websites that host adult material.
What Is Utah Senate Bill 73?
Utah Senate Bill 73 is officially called the Online Age Verification Amendments. It expands Utah’s rules for commercial websites that publish or distribute material considered harmful to minors.
The main goal is simple: stop children from accessing adult content online.
Many U.S. states have introduced age-verification laws for adult websites. These laws often require visitors to prove they are at least 18 before accessing certain content. Utah’s SB 73 goes further because it specifically deals with VPNs, proxies, and other tools that can hide a person’s real online location.
A VPN, short for Virtual Private Network, can route internet traffic through a server in another city or country. For example, someone in Utah could use a VPN server in Canada, Japan, or the United Kingdom. A website may then see the VPN server’s location instead of the user’s true location.
Utah lawmakers wanted to close that possible loophole.
Why Utah’s VPN Rule Is Different
The most talked-about part of SB 73 is its location rule.
Under the law, a person who is physically present in Utah can be treated as a Utah user even when their internet connection appears to come from another place. That means a website cannot simply rely on an IP address to decide that a visitor is outside Utah.
Example of how it works
Imagine that a person is sitting at home in Provo, Utah. They turn on a VPN and connect through a server in Germany. When they visit a website, the website may see a German IP address.
Normally, the website might assume that the person is in Germany. Under Utah’s SB 73 approach, that person is still considered to be in Utah because their real physical location is Utah.
This creates a major challenge for adult websites. A website may not have a reliable way to know whether a person behind a foreign VPN server is actually in Utah, another U.S. state, or a different country.
Does Utah Ban VPNs?
No. Utah’s law does not ban VPNs.
People can still use VPNs for normal and legal reasons, including:
- Protecting personal information on public Wi-Fi
- Accessing a work network while traveling
- Improving privacy while browsing the internet
- Securing online banking or shopping sessions
- Connecting safely while using a hotel, airport, café, or school network
- Preventing some types of tracking from internet providers or public networks
The law does not make it a crime for someone in Utah to download a VPN app, pay for a VPN service, or use a VPN for private browsing.
The important difference is that SB 73 puts responsibility on covered adult websites. These sites are expected to follow Utah’s age-verification rules even when a visitor uses a VPN or proxy.
What Websites Must Do Under SB 73
SB 73 targets commercial websites that knowingly publish or distribute a substantial amount of material considered harmful to minors. This generally means adult-content websites, rather than normal social media apps, streaming platforms, school websites, news sites, gaming websites, or work tools.
A covered website must use a reasonable method to confirm that a visitor is at least 18 years old before giving access to restricted material.
Age verification may involve methods such as:
- Checking a government-issued ID
- Using a third-party age-verification provider
- Confirming age through a secure digital identity system
- Using another system that can reasonably verify that the visitor is an adult
The law also prevents covered websites from helping users bypass age checks through VPNs, proxies, or similar location-masking tools.
That does not mean every online discussion about VPNs becomes illegal. The rule is mainly focused on websites subject to the adult-content age-verification requirements. A general privacy guide, cybersecurity article, or VPN company explaining how its service works is not the same as an adult website telling visitors how to get around its age gate.
Can Users Be Fined $2,500 for Using a VPN?
This is one of the biggest misunderstandings around the Utah VPN law.
Reports often mention fines of up to $2,500 per violation. However, that figure should not be read as a fine that every VPN user may receive.
The possible penalties are aimed at covered commercial entities that violate Utah’s online age-verification requirements. In plain language, the risk is mainly for adult websites or businesses that fail to follow the law, not for a regular person using a VPN for privacy, work, gaming, streaming, or secure browsing.
A better way to explain the rule is:
Utah’s law can impose penalties on covered adult-content websites that fail to follow age-verification requirements. It does not create a general $2,500 fine for anyone who turns on a VPN.
This distinction matters because headlines about “Utah targeting VPN users” can make the law sound broader than it is.
Why Adult Websites Are Concerned
Adult websites and digital-rights groups say the VPN part of SB 73 may be difficult, or even impossible, to follow perfectly.
A VPN is designed to hide or change a user’s visible location. If a visitor connects through a server outside Utah, the website may not be able to tell whether that person is physically in Utah.
This gives websites a hard choice:
- Try to verify the age of more users, including some users outside Utah
- Block traffic from VPNs and proxies
- Restrict access for all Utah visitors
- Risk possible legal action if Utah residents bypass location checks
Some companies argue that blocking all VPN traffic would harm ordinary users who rely on VPNs for security and privacy. Others say stricter age verification is necessary to protect minors from adult content.
The debate is not only about adult websites. It also raises larger questions about online privacy, identity checks, free speech, and how state laws affect the wider internet.
What NordVPN, Surfshark, and AdGuard Say
Major VPN providers have said they do not plan to change how their services work because of Utah’s SB 73.
NordVPN, Surfshark, and AdGuard VPN have all pushed back against the idea that VPN companies should be responsible for solving a website age-verification problem. Their general position is that VPNs are legal privacy and cybersecurity tools, and the law’s requirements are directed at websites that host adult content—not at VPN providers or ordinary users.
This means VPN services are not expected to shut down in Utah or block Utah customers simply because of SB 73. People in the state can still use VPNs for legal and everyday purposes.
However, some adult websites may choose to block VPN traffic, ask for stronger age checks, or restrict access because they want to lower their legal risk.
Is the Law Being Enforced Right Now?
The legal situation is still changing.
SB 73 has faced a court challenge from Aylo, the company behind Pornhub and other adult websites. The challenge argues that the VPN-related rule is difficult to enforce because a website cannot always know a user’s true physical location when that person uses a VPN.
Utah authorities agreed to pause enforcement while the legal dispute is being reviewed. That pause does not mean the law has been permanently cancelled or struck down. It means the state is temporarily holding off on enforcement while a federal court considers the case.
Because the case is ongoing, the final outcome could change. A court could allow the rule to continue, block parts of it, or require Utah to change how the law works.
What Utah Residents Should Know
For most Utah internet users, the practical message is straightforward:
- VPNs are still legal in Utah.
- You can still use a VPN for privacy, work, security, travel, gaming, and public Wi-Fi protection.
- SB 73 mainly affects adult-content websites with age-verification obligations.
- A VPN may not help a person legally avoid Utah’s adult-content age-check rules.
- Some websites may block VPN users or request extra verification to reduce their own legal risk.
- The law remains tied up in a court dispute, so its enforcement status can change.
Final Thoughts
Utah SB 73 is important because it is the first U.S. state law to directly address the use of VPNs and proxies in online age verification. Rather than banning VPNs, the law attempts to stop covered adult websites from treating a masked IP address as proof that a visitor is outside Utah.
The law’s supporters say it closes a loophole that could let minors avoid age checks. Its critics say it creates an unrealistic requirement for websites, threatens online privacy, and could encourage broader restrictions on legal VPN use.
For now, Utah residents do not need to stop using VPNs for normal purposes. The bigger impact will likely fall on adult websites, which must decide whether to strengthen age verification, block some traffic, or challenge the law in court.
