Utah Leads the Charge in Digital Rights Battle with New VPN Age Verification Law
Utah has broken new ground in the ongoing digital rights debate, becoming the first state to directly address the use of Virtual Private Networks (VPNs) in age verification processes. The new legislation mandates that websites hosting adult content must verify the ages of visitors, even when VPNs are employed to mask their location. This places the onus on website operators to determine if users are physically within the state.
SB 73 Targets VPN Use for Age Verification
Utah’s Senate Bill 73 (SB 73) requires commercial websites that “knowingly and intentionally publish or distribute material harmful to minors” to verify the ages of Utah-based visitors. This applies when such material constitutes more than one-third of their content, irrespective of whether visitors use VPNs or proxy servers to conceal their location.
The bill explicitly states, “A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements.”
Under the new law, individuals physically present in Utah are considered Utah users, regardless of their use of VPNs, proxy servers, or other location-disguising tools. VPNs function by routing internet traffic through remote servers, thereby obscuring the IP address that a website would typically identify.
Restrictions on Bypassing Age Checks
The legislation also prohibits website operators from assisting users in bypassing age verification measures. This includes providing instructions on how to access websites via VPNs or evade geographic restrictions.
A tweet from Nym, a privacy company, highlighted a specific provision: “Utah’s SB 73 bans websites from publishing instructions on how to use a VPN to bypass age verification. Publishing information about how VPNs work is now illegal in Utah if it relates to age verification. The law restricts speech about a privacy tool. That is a First…”
Penalties and Compliance
The Division of Consumer Protection is empowered to impose administrative fines of up to $2,500 per violation. Courts can levy civil penalties of a similar amount, in addition to other potential remedies.
The statute also mandates that verification providers must not retain identifying information after granting access. Operators who utilize verification methods that adhere to standards set by the division are considered compliant with the age-verification requirements.
Privacy Advocates Raise Concerns
Privacy company Nym has voiced concerns on X, arguing that SB 73’s prohibition on covered websites offering VPN instructions to circumvent age checks infringes upon speech related to privacy tools. “The law restricts speech about a privacy tool,” the company stated. “That is a First Amendment question the courts have not answered yet.”
Global Trend of VPN Scrutiny
SB 73 represents the latest move by regulators to scrutinize VPNs, both for enforcing platform bans and for preventing users from circumventing age verification.
In September 2024, Brazilian authorities initiated investigations into users suspected of employing VPNs to bypass the country’s temporary ban on X, with potential fines reaching approximately $9,000 per day.
In July 2025, demand for VPNs in the UK surged by over 6,000% following the implementation of age verification measures. Harry Halpin, CEO and co-founder of Nym, attributed this increase to the UK’s “ill-thought-out Online Safety Bill.” Nym, which operates a decentralized VPN service, observed a 12% rise in its NYM token value during this surge, a day after launching its iOS application.
Earlier, in February, France considered restricting minors’ use of VPNs to bypass age controls but ultimately ruled out an outright ban.
Leave a Reply