Utah’s SB 73: The Law That Put VPNs in the Crosshairs
A state-by-state age-verification arms race has reached a new front — and privacy tools are caught in the middle.
On May 6, 2026, Utah’s Senate Bill 73 — formally the “Online Age Verification Amendments” — took effect, making Utah the first U.S. state to explicitly hold websites liable for users who mask their location using a VPN. Signed by Governor Spencer Cox on March 19, 2026, the law targets adult content platforms and bars them from sharing instructions on how to use a VPN to bypass age checks. The Electronic Frontier Foundation (EFF) has flagged it as a landmark privacy threat — one that extends well beyond Utah residents. It builds on a pattern seen across states like Florida, Texas, and Wisconsin, where age-gate laws predictably drove surges in VPN use, only for lawmakers to then target the VPNs themselves. The wider context of platform access controls tightening across devices and operating systems makes Utah’s move part of a much larger shift in how digital access is governed.
What the Law Actually Does
Why Enforcement Is Technically Broken
The Global Pattern: Age Gates → VPN Surges → VPN Crackdowns
Where Things Stand
Utah’s SB 73 was discussed here as the first U.S. law to impose direct liability on websites for VPN-masked users — a legal structure that digital rights advocates, including the Electronic Frontier Foundation, have framed as technically unenforceable and constitutionally suspect. The VPN provisions under Section 14 took effect May 6, 2026, while a separate 2% tax on adult content revenues is scheduled for October 2026.
NordVPN’s characterisation of SB 73 as an “unresolvable compliance paradox” and the EFF’s warnings about a potential global spillover effect — affecting ordinary internet users, journalists, abuse survivors, and anyone relying on commercial VPNs for data security — were covered across these developments. The law has been positioned alongside the UK’s House of Lords vote, France’s stated intentions, and Australia’s enforcement rollout as part of a broader international pattern in how governments are responding to age-verification circumvention. Related digital policy shifts continue to evolve across jurisdictions.
