Utah’s VPN age verification law goes into effect on May 6, and it is already drawing sharp criticism from digital privacy advocates, cybersecurity companies, and legal experts. The legislation, known as Senate Bill 73 or the Online Age Verification Amendments, makes Utah the first U.S. state to explicitly target VPN use within its age check framework. Under the law, websites carrying material deemed harmful to minors must verify user ages — and they remain legally liable even when users route their connection through a virtual private network to mask their location.
What the Utah VPN age verification law actually requires
The core of the law is straightforward. Any website with a substantial portion of material harmful to minors must check the age of users before granting access. What makes this law different from similar legislation in other states is how it handles VPN use. The bill states directly that a person accessing a website through a VPN is still considered to be accessing it from Utah if they are physically located in the state, regardless of what their IP address suggests.
The law goes further. Affected websites are also prohibited from providing any instructions to users on how to use a VPN to bypass age checks. That combination — liability for VPN workarounds plus a ban on informing users how those workarounds function — creates a legal situation that critics say has no practical solution for the businesses it targets.
Why privacy experts say the law creates an impossible situation
NordVPN was direct in its assessment. In a statement shared with TechRadar, the company said that reliably identifying and blocking Utah-based VPN users trying to bypass age verification would be technically impossible. The company described the situation as a liability trap for affected businesses, arguing that no current technology can consistently determine whether a VPN user is physically located in Utah.
The Electronic Frontier Foundation, a nonprofit focused on digital civil liberties, went further in its criticism. The organization argued that the law presents no clean path forward for adult websites facing compliance pressure. According to the foundation, the legal risk the law creates could push sites toward two extreme responses. First, banning all known VPN IP addresses entirely. Second, requiring age verification from every visitor worldwide, regardless of where they actually live. Either outcome would subject millions of users to invasive identity checks or blocks on their VPN use, even if those users have no connection to Utah whatsoever.
The broader context driving age verification laws across the U.S.
Utah’s law does not exist in isolation. Age verification has become one of the most active areas of internet legislation across the country. California has passed a law requiring operating systems including Linux to verify user ages at account setup, with that measure set to take effect next year. At the federal level, the Parents Decide Act could introduce similar requirements across the entire nation.
Experts have raised consistent concerns about the direction this legislation is taking. Researchers have warned that age verification systems, if built without careful consideration of privacy and security, could cause more harm than the problems they aim to solve. The core tension is a real one. Protecting minors online is a legitimate and urgent goal. However, the methods being considered increasingly require users to hand over sensitive personal data to third parties in order to prove who they are.
What this means for everyday VPN users
For the average person using a VPN for privacy, security, or simply to access content, Utah’s law raises a practical concern that goes beyond state borders. If websites begin blocking all VPN traffic to avoid liability under laws like this one, the impact falls on every VPN user globally, not just those in Utah.
The Electronic Frontier Foundation made clear that this kind of legislative creep where one state’s law effectively reshapes how websites treat users everywhere sets a worrying precedent. Utah’s law is not a direct ban on VPN software. However, by making websites liable for VPN-assisted workarounds, it creates strong financial incentives for those sites to restrict VPN access across the board. The result could be a measurable erosion of the privacy tools that millions of people rely on every day.
Source: PC Gamer
Leave a Reply