Utah’s VPN Age‑Verification Law Starts This Week: Inside SB 73 and Its Ripple Effects

Utah’s VPN Age-Verification Law Takes Effect May 6: What SB 73 Actually Does

Utah will flip the switch this week on a first-of-its-kind expansion to state age‑verification rules for adult websites. Signed by Governor Spencer Cox on March 19, 2026, Senate Bill 73 (the Online Age Verification Amendments) clarifies that a visitor is deemed to be accessing a site “from this state” if they are physically in Utah—“regardless of whether the individual is using a virtual private network [VPN], proxy server, or other means” to mask location. The core provisions take effect Wednesday, May 6, 2026. (le.utah.gov )

Multiple tech outlets and digital-rights advocates say that language effectively makes Utah the first U.S. state to hold websites liable for users who try to bypass age gates with VPNs. (tomshardware.com )

Key provisions at a glance

• Who must age‑verify: Commercial entities that “knowingly and intentionally” publish or distribute material harmful to minors on a website containing a “substantial portion” of such content must perform reasonable age‑verification. The law retains a statutory threshold—“substantial portion” means more than 33⅓%—and adds a rebuttable presumption based on branding and promotion. (le.utah.gov )

• VPN and location masking: A person is considered to be accessing a site from Utah if actually located in the state, even when using a VPN, proxy, or other spoofing method. (le.utah.gov )

• Anti‑circumvention messaging: Covered sites may not “facilitate or encourage” use of a VPN or proxy to evade age checks, including by publishing instructions or tools to bypass geoblocks. (le.utah.gov )

• Enforcement shift and safe harbor: The Division of Consumer Protection gains explicit authority to investigate, hold hearings, issue cease‑and‑desist orders, and impose fines; sites that use an age‑verification method approved by the Division receive a compliance safe harbor. Rulemaking will set standards for both “substantial portion” determinations and acceptable verification methods. (le.utah.gov )

• New 2% excise tax: Beginning October 1, 2026, a 2% excise tax applies to “covered transactions” by covered entities, with proceeds routed to a new Minor Mental Health Restricted Account and to enforcement. (le.utah.gov )

• Effective dates: Most provisions take effect May 6, 2026; tax sections begin October 1, 2026. (le.utah.gov )

Why VPNs are at the center of the debate

Digital‑rights groups warn SB 73 creates a “liability trap”: because sites can’t reliably detect the real‑world location of every VPN user, some operators could respond by blocking known VPN IP ranges across the board—or by requiring age verification for all visitors globally. NordVPN called that approach “technically impossible” given constantly changing IP inventories. (tomshardware.com )

Tech policy reporters likewise describe the bill’s VPN clause as a compliance problem without a clean technical fix, likening enforcement to “whack‑a‑mole.” (techradar.com )

How Utah got here

• 2023 groundwork: Utah’s first age‑verification law (SB 287) took effect in May 2023. Pornhub and other major adult sites responded by blocking Utah visitors rather than collecting IDs, citing privacy risks. (latimes.com )

• Early litigation: The Free Speech Coalition sued, but the challenge ran into procedural headwinds over who could be sued to block enforcement. In 2024, the Tenth Circuit left a dismissal in place without reaching the constitutional merits. (law.justia.com )

• SB 73’s response: The new law replaces the prior private‑lawsuit scheme with agency enforcement by the Division of Consumer Protection and adds the VPN/location language at issue. Industry advocates highlight those changes while signaling further legal challenges. (action.freespeechcoalition.com )

What changes for Utahns on May 6, 2026

• Expect more ID gates or blocks: Sites meeting the “substantial portion” test face liability if they do not age‑verify Utah‑located users—even those behind VPNs—so more properties may either implement ID checks (via third‑party verification, digitized IDs, or transactional‑data methods) or block Utah traffic outright. (le.utah.gov )

• VPN use itself isn’t outlawed: SB 73 does not ban consumers from using VPNs. But covered sites are barred from posting how‑to guides or other tools to help users bypass Utah geofencing, and operators may choose to block or degrade access for VPN IPs. (le.utah.gov )

• Privacy guardrails: The statute reiterates that entities performing age verification “shall not retain” identifying information after granting access—details the Division must flesh out in forthcoming rules. (le.utah.gov )

What it means for platforms and publishers

• Determine coverage: Audit whether more than 33⅓% of on‑site material could meet Utah’s “harmful to minors” definition; branding, domain names, and promotional content create a rebuttable presumption of coverage. (le.utah.gov )

• Implement an approved method: Safe harbor attaches when using an age‑assurance method that conforms to Division rules. Options enumerated in statute include third‑party verification against government‑grade databases, digitized ID, or “commercially reasonable” transactional‑data checks. (le.utah.gov )

• Prepare for location disputes: Because liability attaches to Utah‑located users regardless of masked IPs, counsel and engineering teams should document geolocation logic, exception handling for VPN/proxy traffic, and protocols for responding to user‑reported location issues. Policymakers and advocates warn that over‑blocking VPNs could inadvertently lock out legitimate users and enterprise traffic. (tomshardware.com )

• Budget for the tax: If covered, plan for the 2% excise tax on digital content transactions beginning October 1, 2026, with records retention and filing requirements enforced by the State Tax Commission. (le.utah.gov )

National context: courts and copycat laws

Utah’s move lands amid a broader state‑by‑state push. In April 2024, the U.S. Supreme Court allowed Texas’s age‑verification law to remain in effect during litigation, signaling headwinds for industry challenges and emboldening legislatures. Meanwhile, Wisconsin dropped a proposed VPN‑blocking requirement after sharp backlash from security experts and civil‑liberties groups. (apnews.com )

Timeline and what to watch next

• May 6, 2026: SB 73’s enforcement, VPN/location provisions, and Division authorities take effect. (le.utah.gov )
• July 1, 2026: Certain administrative updates to consumer‑protection statutes take effect. (le.utah.gov )
• October 1, 2026: The 2% covered‑entity excise tax begins; first reporting periods follow per Tax Commission schedules. (le.utah.gov )

The pivotal variable now is rulemaking. The Division of Consumer Protection must define acceptable verification standards, privacy and data‑security requirements, and methodologies for calculating “substantial portion.” Those rules will determine whether compliance is narrowly targeted or pushes sites toward blanket age checks—and whether Utah’s approach becomes a model or a cautionary tale for other states. (le.utah.gov )