May 4, 2026 Utah Senate Bill 73 takes effect May 6, making Utah the first U.S. state to explicitly regulate VPN use as part of online age verification requirements. The law treats users as being in Utah based on their physical location regardless of VPN or proxy use, and bars websites from providing instructions on how to bypass checks.
Signed by Spencer Cox on March 19, the legislation expands existing age-verification rules by shifting liability onto websites. Platforms must determine whether users are accessing content from within Utah even when those users are actively masking their location, creating new compliance obligations for publishers and online services.
Industry groups say that requirement is difficult to meet in practice. NordVPN described the law as an “unresolvable compliance paradox” and a “liability trap,” arguing that it effectively asks websites to identify users whose tools are designed to avoid identification. The Electronic Frontier Foundation warned that the risk could push sites to block VPN traffic outright or apply age checks to all users, not just those in Utah.
The technical challenge is central to the criticism. While tools such as IP reputation databases can flag known datacentre traffic, VPN providers frequently rotate addresses, and residential VPN endpoints often appear indistinguishable from standard home connections. Methods such as Autonomous System Number analysis can identify some infrastructure patterns, but cannot reliably detect personal VPN setups running on common cloud services.
More advanced detection techniques exist but are not available to typical websites. Deep packet inspection, which can identify VPN protocol signatures, requires access to network-level infrastructure between users and servers. Systems like China’s Great Firewall and Russia’s TSPU operate at that level, but individual web platforms do not have that visibility or control.
Critics also point to uneven real-world effects. Setting up a personal VPN using tools like WireGuard on a cloud provider takes minutes, making it easier for technically proficient users to bypass restrictions. Meanwhile, users who rely on commercial VPNs for privacy, including journalists, activists and abuse survivors, may face access barriers if sites begin blocking known VPN traffic.
Utah’s move reflects a broader policy trend, as the United Kingdom’s House of Lords has already voted to restrict VPN use for minors, with further debate expected in the House of Commons. VPN usage surged more than 1,400% on the first day of age-verification enforcement in the U.K. last year. France has also signalled interest in targeting VPNs, while similar proposals in Wisconsin were dropped after public backlash.
