Utah Becomes First State to Target VPNs in Age-Verification Crackdown

Utah is testing new floor within the digital rights battle, changing into the primary state to instantly goal VPN use for age verification.

The state will now require web sites that host grownup materials to confirm guests’ ages even when VPNs disguise their location, placing operators on the hook for figuring out whether or not customers are bodily contained in the state.

Utah’s SB 73 requires business web sites that “knowingly and deliberately publish or distribute materials dangerous to minors” to confirm Utah guests’ ages when that materials exceeds one-third of their content material—even when guests conceal their location with VPNs or proxies.

“A business entity that operates a web site that comprises a considerable portion of fabric dangerous to minors could not facilitate or encourage using a digital personal community, proxy server, or different means to avoid age verification necessities,” the invoice mentioned.

Underneath the regulation, guests bodily in Utah rely as Utah customers no matter whether or not they use a digital personal community, proxy server, or one other instrument to disguise their location. VPNs route site visitors by distant servers, concealing the IP handle a web site would in any other case see.

The invoice additionally restricts operators from serving to guests bypass age checks, together with by offering directions for accessing their web sites by VPNs or evading geographic blocks.

The Division of Shopper Safety can impose administrative fines of as much as $2,500 per violation. Courts can impose civil penalties of as much as $2,500 per violation, alongside different treatments.

The statute additionally prohibits verification suppliers from retaining figuring out data after granting entry. Operators utilizing verification strategies that meet requirements established by division guidelines are deemed compliant with the age-verification necessities.

Privateness firm Nym argued on X that SB 73’s prohibition on lined web sites offering VPN directions to bypass age checks restricts speech about privateness instruments.

“The regulation restricts speech a few privateness instrument,” the corporate wrote. “That may be a First Modification query the courts haven’t answered but.”

SB 73 is the most recent motion by regulators focusing on VPNs each to implement platform bans and to cease customers bypassing age checks.

In September 2024, Brazilian authorities began investigating users suspected of utilizing VPNs to evade the nation’s short-term ban on X, with potential fines approaching $9,000 a day.

In July 2025, UK VPN demand surged more than 6,000% as age checks took impact.

“The explanation there’s a rise is as a result of the UK handed an ill-thought-out On-line Security Invoice,” Nym CEO and co-founder Harry Halpin instructed Decrypt on the time.

Nym, which operates a decentralized VPN service, noticed its NYM token climb 12% in the course of the surge, a day after launching its iOS app.

In February, France considered restricting minors’ use of VPNs to bypass age controls, whereas officers dominated out an outright ban.