On May 6, 2026, Utah became the first American state to effectively target virtual private networks through age verification legislation - not by banning the technology outright, but by making it legally irrelevant to websites that host adult content. The move, embedded in Senate Bill 73, shifts liability for minors accessing explicit material onto platforms themselves, regardless of whether a user masks their location through a VPN. The implications extend far beyond Utah's borders.
What SB73 Actually Does - and Why It's Harder Than It Looks
Utah's Online Age Verification Amendments, signed by Republican Governor Spencer Cox in March 2026, primarily taxes websites that exhibit adult content while introducing a liability framework that places legal responsibility squarely on platforms. If a minor in Utah accesses a site with harmful material, the website is liable - even if that minor used a VPN to disguise their physical location.
The practical problem is immediate: websites cannot reliably determine where a VPN user actually is. VPN providers continuously rotate IP addresses, rendering blocklists obsolete almost as soon as they are compiled. Popular VPN provider NordVPN has characterized this as a "liability trap" - because the legal obligation is technically unenforceable against VPN users, platforms face pressure to apply age verification universally, subjecting users with no legal obligation to comply to invasive identity checks.
SB73 adds a second provision: entities that host a substantial proportion of content harmful to minors are barred from sharing information about VPNs with users. The Electronic Frontier Foundation, a nonprofit dedicated to defending digital rights, describes the resulting regime as a "don't ask, don't tell" policy - websites are likely only obligated to request proof of age if they actually learn a user is physically in Utah and using a VPN. Far from offering clarity, the EFF argues that this ambiguity creates a dangerous precedent that threatens to undermine digital privacy rights structurally, not incidentally.
The Privacy Cost of Verification
Age verification is not a neutral technical requirement. Enforcing it demands access to sensitive personal data - government-issued identification, biometric readings, or behavioral and browsing data fed into algorithmic systems. Increasingly, major technology platforms are processing combinations of this data through AI-driven age estimation tools. The Electronic Frontier Foundation has noted that each of these methods requires users to hand over personal information that permanently links their offline identity to their online activity.
That linkage carries real risk. Several high-profile breaches of age verification providers in recent years have exposed the vulnerability of centralized identity data. Critics argue that age verification infrastructure, once built, functions as surveillance architecture - capable of being repurposed well beyond child safety mandates. The data collected to verify a teenager's age does not disappear after a single login.
A Precedent With Reach Beyond Utah
Utah's approach is notably less extreme than some proposals that have circulated in American legislatures. Wisconsin advanced - and ultimately abandoned - a bill that would have banned VPN technology outright. Michigan considered similar measures. What makes SB73 consequential is precisely its subtlety: by treating VPN usage as a liability variable rather than an outright prohibited act, it expands the range of policy tools available to legislators looking to regulate online behavior without triggering the constitutional objections that a hard ban would invite.
This dynamic mirrors developments in other liberal democracies. The United Kingdom and Australia have both implemented age verification regimes for adult content, each encountering the same enforcement gap - VPNs allow users to circumvent regional restrictions with minimal technical knowledge. The jurisdictions that have historically restricted VPN access most aggressively - North Korea, Belarus, China, Russia - have done so as components of comprehensive state censorship systems. The fact that democratic governments are now confronting the same enforcement problem, and reaching for analogous solutions, warrants careful scrutiny.
The underlying policy question is not whether children should be protected from harmful content online. Few serious observers dispute that goal. The question is whether age verification mandates, as currently constructed, are capable of achieving it - or whether they instead create expansive data collection obligations, push users toward less secure workarounds, and establish legal frameworks that can be extended to other categories of content over time. Utah's SB73 does not resolve that tension. It intensifies it.
