Utah's Senate Bill 73, known as the Online Age Verification Amendments, will take effect on May 6, making Utah the first U.S. state to enforce age-verification rules that specifically target VPN use on adult websites [1].
The law requires websites with substantial content harmful to minors to check the age of all users. If users try to bypass these checks using a VPN, the website remains responsible for preventing underage access, holding sites liable even when VPNs obscure users' locations [1].
According to the bill, “an individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network,” emphasizing physical location over IP masking [1].
Affected websites are also forbidden from providing instructions on how to use VPN services to circumvent age verification [1].
Privacy and tech companies have voiced skepticism about the law's technical feasibility. A spokesperson for NordVPN called reliably identifying and blocking Utah-based VPN users "technically impossible" and warned the rules create a "liability trap" for businesses required to enforce them [1].
The Electronic Frontier Foundation criticized the legislation, stating it leaves "no clean way out for adult sites" and could set a "dangerous precedent" for internet regulation [1].
The law goes into effect tomorrow, May 6, requiring websites meeting its criteria to comply with the new age-verification and VPN restrictions or face penalties.
