Utah becomes the first US state to target VPNs with a strict age verification law, but top providers refuse to budge

Utah’s SB 73 takes effect today, September 3, but ongoing legal challenges mean strict enforcement could remain paused.

Anyone physically in Utah is legally treated as a resident, even if they use a VPN to mask their location, and websites face a $2,500 penalty per violation.

Leading VPN providers confirm they will not change how their services operate in Utah, calling the legislation a "dangerous precedent" that fails to solve age assurance.

Utah has become ground zero for a major digital rights battle.

Following months of intense legal wrangling, Utah’s Senate Bill 73 (SB 73) comes into effect today, September 3.

Originally scheduled for a May rollout, the law was temporarily paused following a court injunction.

That initial pause has now expired, allowing the law to come into effect and making Utah the first US state to explicitly target VPN use for age verification mandates .

But the cybersecurity industry is warning that the legislation remains a convoluted, unenforceable mess.

As reported by Gizmodo , SB 73, formally known as the Online Age Verification Amendments, requires commercial websites hosting adult material to verify user ages.

The privacy concerns lie in how the state handles location spoofing: anyone physically located in Utah is legally treated as a Utah user, regardless of the IP address they present to a website.

This means if a resident of Salt Lake City connects to a VPN server in Germany, they are still a Utah user in the eyes of the law, and the website remains legally liable for verifying their age.

If websites fail to comply, they face severe penalties reaching $2,500 per violation. (Image credit: Shutterstock / Kaspars Grinvalds) A "dangerous precedent" for privacy tools To comply with the law, websites may be forced to use highly intrusive tracking measures or block all suspected VPN traffic.

Furthermore, adult websites are now legally barred from publishing instructions on how to use a VPN to circumvent the state's age gates.

Digital rights groups have previously slammed the framework as an "impossible by design" waste of money that simply creates a technical whack-a-mole .