Utah becomes the first US state to target VPNs with a strict age verification law, but top providers refuse to budge

Date:
Thu, 03 Sep 2026 09:33:44 +0000

Utahs unprecedented age verification law takes effect today, explicitly targeting VPN use and treating anyone physically in the state as a resident. However, top privacy providers like NordVPN and AdGuard are pushing back against the "rushed-out" legislation, warning of severe consequences for digital rights. Following months of intense legal wrangling,
Utahs Senate Bill 73 (SB 73) comes into effect today, September 3.

Originally scheduled for a May rollout, the law was temporarily paused following a court injunction. That initial pause has now expired, allowing
the law to come into effect and making Utah the first US state to explicitly target VPN use for age verification mandates . But the cybersecurity industry is warning that the legislation remains a convoluted, unenforceable mess.

As reported by Gizmodo , SB 73, formally known as the Online Age Verification Amendments, requires commercial websites hosting adult material to verify
user ages.

The privacy concerns lie in how the state handles location spoofing: anyone physically located in Utah is legally treated as a Utah user, regardless of the IP address they present to a website.

This means if a resident of Salt Lake City connects to a VPN server in Germany, they are still a Utah user in the eyes of the law, and the website remains legally liable for verifying their age. If websites fail to comply, they face severe penalties reaching $2,500 per violation.

To comply with the law, websites may be forced to use highly intrusive tracking measures or block all suspected VPN traffic. Furthermore, adult websites are now legally barred from publishing instructions on how to use a VPN to circumvent the state's age gates.

Digital rights groups have previously slammed the framework as an "impossible by design" waste of money that simply creates a technical whack-a-mole . This legislative push isn't happening in a vacuum, as authorities globally, including the EU, increasingly view VPNs as circumvention software that needs to be restricted .

However, some VPNs are refusing to alter their services for Utah
residents, noting that the legal burden falls entirely on website operators.

Speaking exclusively to TechRadar, Laura Tyrylyte, privacy advocate at NordVPN, clarified that the September 3 rollout is far from final. "The legal challenge to the law is still ongoing, so September 3 should not be treated
as a set enforcement date. Depending on how things move, enforcement could remain paused while litigation continues," Tyrylyte explained.

"That said, SB 73 does not affect NordVPN directly as the law's obligations fall on websites that host content deemed harmful to minors, not on VPN providers," she continued. "However, the trend of rushed-out laws that are impossible to comply with is far from reassuring, and we will continue to advocate for approaches to child safety that don't sacrifice the
cybersecurity and privacy tools that protect everyone."

AdGuard VPN has taken a similar stance. Denis Vyazovoy, Head of Products at AdGuard, confirmed to TechRadar that the company has no intention of restricting its local users.

We dont currently see Utahs SB 73 as creating direct compliance obligations for VPN providers, so we dont plan to change how AdGuard VPN works for users in Utah," Vyazovoy said. "More broadly, treating VPNs as a loophole in age-verification policy sets a dangerous precedent: VPNs are general-purpose privacy and security tools, and restricting them risks harming legitimate users without solving the underlying problem of age assurance.

Gytis Malinauskas, Head of Legal at Surfshark, told TechRadar that Utah's SB 73 sets a concerning precedent. "In practice, it requires sites that host content deemed harmful to minors to block VPNs. This treats a core cybersecurity tool as a loophole. VPNs are a standard security tool millions of Americans use every day to protect their data. Blocking them would only erode the privacy of ordinary users," he said.

For now, everyday encryption remains completely legal in Utah. However, as
the burden of proof shifts to website operators, users can expect to face significantly more invasive identity checks, or blanket blocklists, as companies attempt to navigate the new state rules.

Link to news story: https://www.techradar.com/vpn/vpn-privacy-security/utah-becomes-the-first-us-s tate-to-target-vpns-with-a-strict-age-verification-law-but-top-providers-refus e-to-budge

$$
--- MultiMail/DOS
* Origin: capitolcityonline.net * KY, USA (1:2320/107)