Utah's New VPN Law 'Sets a Dangerous Precedent' And Your Privacy Could Be Next

Utah wants certain websites to know where you are, even when the privacy tool you use is designed to conceal that information.

Senate Bill 73 makes adult websites responsible for age-verifying users physically located in Utah, including people whose VPN or proxy server makes them appear to be somewhere else.^[1] Yet websites generally cannot see a VPN user’s true location.

That leaves companies with some ugly choices: Attempt to block VPN traffic, demand identification from far more visitors, or risk penalties for failing to detect information they may have no reliable way to obtain.

Major VPN providers say they will not change their services to accommodate the law.

“Treating VPNs as a loophole in age-verification policy sets a dangerous precedent,” AdGuard Head of Products Denis Vyazovoy said. “VPNs are general-purpose privacy and security tools, and restricting them risks harming legitimate users without solving the underlying problem of age assurance.”^[2]

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

Utah says your physical location counts

Gov. Spencer Cox signed SB 73, formally called the Online Age Verification Amendments, on March 19, 2026.

It applies to commercial websites on which more than one-third of the material is considered harmful to minors. These sites must use a “reasonable age verification method” before allowing someone to access that material.

Permitted methods include a digital identification card, a third-party verification service that compares personal information against commercial databases, or another commercially reasonable system that uses transactional data.

The law also declares that someone physically located in Utah counts as a Utah user “regardless of whether” that person uses a VPN, proxy server, or another method to disguise their location.

However, that creates a technical problem no statute can magically solve.

A VPN encrypts your traffic and routes it through a remote server. The website sees the server’s IP address instead of your home IP address. If someone in Salt Lake City connects through a server in another state, the website may have no dependable way to determine that the visitor is actually in Utah.

The law affects users everywhere

The law does not directly require VPN providers to verify anyone’s age or disclose their location. Its obligations fall on the websites covered by SB 73.

However, those websites must account for Utah users whose locations have been concealed. According to the Electronic Frontier Foundation, that could push companies to block known VPN addresses or require age verification from every visitor, regardless of where they live.

Either approach would affect lawful users far beyond Utah state lines.

VPN addresses are difficult to identify comprehensively. Providers regularly introduce new servers and IP addresses, while residential proxies can make traffic appear to come from an ordinary home connection. A determined teenager may still find a route around a blocklist.

Meanwhile, adults using VPNs for everyday privacy could encounter more blocked pages and demands for identification. Businesses, journalists, abuse survivors, travelers, and remote workers also rely on VPNs to secure their communications.

The law could therefore punish people who use a legitimate security tool while failing to stop the users it is intended to catch.

The law is active but currently unenforced

SB 73 was initially scheduled to take effect on May 6. Aylo, the parent company of Pornhub, RedTube, and YouPorn, filed a federal lawsuit challenging the law in April.

Utah first agreed to delay enforcement until September 3. When that deadline arrived, state authorities extended the pause while awaiting the federal judge’s decision.

The pause is not a repeal or a final ruling that the law is unconstitutional. It simply prevents Utah from enforcing the challenged requirements while the case remains unresolved.

The bottom line

A reputable VPN can still encrypt your connection, conceal your IP address from websites, and make it harder for advertisers, data brokers, or criminals to track your activity.

That said, it’s best to be cautious when a website asks you to upload identification or submit personal information for an age check. Make sure that you are on the legitimate website, identify the company handling the verification, and read what it collects before providing anything.

For now, Utah’s experiment is stalled in court. If SB 73 survives, other lawmakers may treat it as a blueprint for closing the supposed VPN “loophole.”

All-in-One Digital Security App

5.0

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Get Deal

On NordVPN's website

2026 Editors’ Choice

Best Features

VPN

NordVPN

PROMOTION: Get 75% Off + 3 Months Extra

• VPN that earned the only Platinum rating in a five-way independent speed and security test by Artifact Security
• Historically unlocks Netflix libraries in the US, Canada, UK, and Australia with no errors
• Bundles with ad blocker, data removal, and encrypted storage for a more complete privacy setup

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.