Utah Targets VPNs in First-of-Its-Kind Age-Verification Crackdown

Utah has enacted SB 73, making it the first U.S. state to specifically target the use of VPNs and proxies to bypass age verification on websites hosting adult material. The law aims to close digital loopholes that allow minors to evade age-gating by masking their geographic location.

Under the new regulations, commercial websites where material harmful to minors exceeds one-third of their total content must verify the age of Utah visitors. Crucially, the law mandates this verification regardless of whether a user employs location-masking tools. To ensure compliance, SB 73 prohibits these websites from facilitating or encouraging the use of VPNs or proxy servers to circumvent these checks, which includes a ban on publishing instructions on how to use such tools for evasion. Violations of these rules carry administrative and civil penalties of up to $2,500 per violation. To mitigate privacy concerns, the law legally bars verification providers from retaining identifying information once access has been granted.

Global Regulatory Trends

Utah's legislative move mirrors a broader global trend where regulators are increasingly attempting to enforce digital age limits and platform bans through technical restrictions. Similar efforts have emerged internationally, including the UK's Online Safety Bill and France's considerations regarding VPN restrictions for users under 15 on social media. Brazil has also conducted investigations into VPN users who utilized the tools to evade a national ban on the platform X. These actions signal a shift toward more aggressive state-level intervention in how users navigate the open web.

Implications for Digital Privacy

By targeting the tools used to maintain anonymity, Utah is shifting the burden of location detection onto website operators. This approach potentially criminalizes the distribution of technical information regarding privacy tools, creating a significant legal precedent. The law moves beyond simply requiring age checks; it actively restricts the dissemination of information about how to maintain digital privacy. This shift raises fundamental questions about the right to anonymity and the extent to which a state can regulate the technical means of accessing information.

Legal Challenges Ahead

The law is expected to face significant scrutiny regarding its constitutionality. Nym, a privacy company, noted that the law restricts speech about a privacy tool, describing it as a First Amendment question that courts have not yet answered. As other states look to Utah's model, the legal battle will likely center on whether the state's interest in protecting minors outweighs the First Amendment rights of users and the freedom of speech for those providing technical privacy guidance.