Your email could be compromised.
Scan it on the dark web for free – no signup required.
Utah just made history, and not the good kind.
Starting September 3, 2026, Utah is officially the first US state to enforce a law that puts VPNs directly in its crosshairs. The internet has spent the last few days calling it an “anti-VPN law,” and if you’ve seen the headlines without the fine print, you’d be forgiven for thinking your VPN just became illegal.
It didn’t. But what actually happened is arguably more interesting, and it says a lot about where internet privacy regulation is headed next.
Here’s the full breakdown:
Key Points
- Utah’s Senate Bill 73 (“Online Age Verification Amendments”) takes effect September 3, 2026, after a court-ordered delay pushed it back from its original May 6 start date.
- VPNs are not banned. Using one in Utah, or anywhere in the US, remains completely legal.
- The law makes websites, not VPN users, legally responsible for verifying the age of anyone physically located in Utah, VPN or no VPN.
- It also bars certain sites from publishing instructions on how to use a VPN to dodge age checks.
- The law only applies to adult content platforms. Your banking app, streaming service, and work VPN are untouched.
The Timeline: How Utah Got Here
This law didn’t appear overnight, and its bumpy road to enforcement is part of the story.
- January 5, 2026 — Sen. Calvin Musselman introduces SB 73.
- February 23, 2026 — Passes the Utah Senate, 22–2.
- March 4, 2026 — Passes the Utah House, 66–1.
- March 19, 2026 — Governor Spencer Cox signs it into law.
- May 6, 2026 — Original effective date.
- May 11, 2026 — Enforcement paused after Aylo, Pornhub’s parent company, sues.
- September 3, 2026 — The law officially kicks in.
Worth noting: most of SB 73 has nothing to do with VPNs at all. The bulk of it introduces a 2% tax on adult content revenue, starting in October. The VPN provisions are tucked into one section, Section 14, and that’s what’s been making headlines for months.
What Section 14 Actually Does?
Strip away the panic, and Section 14 does exactly two things.
1. Your physical location beats your VPN location
If you’re physically standing in Utah, the law treats you as accessing a website from Utah, full stop. It doesn’t matter what your VPN, proxy, or IP-masking tool tells that website. Your GPS coordinates, not your virtual ones, are what count in the eyes of the law.
The catch? A VPN’s entire job is to make your real location invisible. Asking a website to reliably detect something that’s specifically engineered to be undetectable is, to put it gently, a technical contradiction.
2. Sites can’t teach you how to use a VPN to dodge checks
Covered websites are now banned from facilitating, encouraging, or explaining how to use a VPN to bypass their age gates. This is the piece that’s drawn the sharpest criticism; it’s not regulating a tool, it’s regulating information about a tool.
VPNs are legal. Explaining how they work is normally protected speech. Digital rights groups argue this crosses into First Amendment territory, and a legal challenge here feels less like a possibility and more like a matter of time.
Who Does This Actually Apply To?
Just one category: commercial websites where more than one-third of the content is considered harmful to minors.
That’s it. This is not a blanket internet law. It doesn’t touch:
- Your everyday browsing
- Streaming platforms
- Remote work VPNs
- Public Wi-Fi protection
- Any site that isn’t hosting adult content at scale
If your VPN use looks like most people’s, hiding your traffic on airport Wi-Fi, unblocking a show you already pay for, or keeping your ISP from selling your browsing habits, this law was never written with you in mind.
Why Are Privacy Advocates Still Sounding the Alarm?
Age verification laws aren’t new; over two dozen US states already have them. What makes Utah different is that it’s the first to fold VPNs into the equation, and critics say that single move creates problems far bigger than Utah’s borders.
It sets an impossible technical standard. Websites are being asked to identify VPN users’ real locations, something VPNs are built to prevent. That leaves them with three unappealing options: verify every visitor globally, block all known VPN IP ranges, or cut off Utah entirely.
It could affect users who’ve never set foot in Utah. If sites choose the “block all VPN traffic” route to limit liability, users anywhere could get swept up in the fallout.
It’s a preview, not a one-off. Wisconsin drafted near-identical VPN provisions earlier in 2026, then stripped them out after backlash from privacy advocates and the tech industry over constitutional risk. Utah pushed forward regardless, and lawmakers in the UK and France have both floated similar “VPN loophole” language recently.
The speech restriction may not survive a court fight. Regulating a device is one thing. Regulating truthful information about a legal device is a different, much shakier category, and it’s the part most likely to get challenged and potentially struck down.
Frequently Asked Questions (FAQs)
No. VPNs remain 100% legal to use in Utah and across the US. The law places obligations on websites, not on individuals using a VPN.
The law targets the website’s compliance obligations, not the individual user’s legal liability for simply connecting through a VPN.
No. The law is scoped narrowly to commercial adult content platforms. Everyday VPN use for privacy, security, or streaming is unaffected.
Potentially, indirectly. If affected websites respond by blocking VPN traffic broadly or verifying every global visitor to reduce legal risk, users outside Utah could feel the ripple effects even though the law itself only targets Utah-based access.
Unlikely. Utah is the first state to pass this kind of law, but similar language has already surfaced in other state legislatures and internationally. Expect this to be a bigger conversation, not a smaller one, over the next year.
The Bottom Line
Utah didn’t outlaw VPNs, it did something narrower and, in its own way, more consequential: it made a website’s liability depend on detecting something that’s deliberately undetectable. Whether that holds up in court, gets copied by other states, or quietly unravels the way Wisconsin’s version did remains to be seen.
For now, if you’re using a VPN for the reasons most people do, nothing changes for you. But this is exactly the kind of law worth watching because “first of its kind” rarely stays that way for long.
