On September 3, 2026, Utah became the first US state to write VPNs directly into an internet law. Senate Bill 73, the "Online Age Verification Amendments," says that a person physically in Utah counts as a Utah user no matter what IP address they show. A website can't escape its age-verification duty just because a visitor connected through a VPN. Three weeks later, on September 24, a federal judge blocked that provision. If you use a VPN in the US, or anywhere lawmakers are watching Utah, here's what happened and what it actually means for you.
Table of Contents
What SB 73 Actually Says
Governor Spencer Cox signed SB 73 on March 19, 2026. It amends Utah's existing age-verification rules for commercial websites where more than one-third of the content is considered harmful to minors, which in practice means adult sites. It adds three things:
- Physical location beats IP address. Someone physically in Utah counts as a Utah user even when their traffic arrives from a VPN server in another state or country.
- Sites carry the liability. If a Utah resident gets past an age gate with a VPN or proxy, the website can be held responsible, not the user.
- No "how-to" instructions. Covered sites may not publish instructions for using a VPN to get around age verification.
Violations carry penalties of up to $2,500 each, plus civil liability. The law was supposed to take effect in May. An earlier court challenge from Aylo, the parent company of Pornhub, delayed it, and it finally took effect on September 3.
Is This a VPN Ban? No.
Despite the headlines, SB 73 does not make it illegal to use a VPN in Utah. It puts no duties on VPN providers and no penalties on people who use them. Using a VPN to secure public WiFi, keep your browsing private from your ISP, reach your bank while traveling, or protect a remote-work connection is just as legal in Utah as it was before. The law only changes what a narrow category of adult websites must do. For a broader look at where VPN rules stand, see our guide to VPNs and data protection laws.
The September 24 Injunction
Aylo kept fighting, and on September 24, 2026, US District Judge David Barlow granted a preliminary injunction against the "actual location" provision, the part that reaches users who hide their location. The judge found that Aylo was likely to win its argument that the provision violates the dormant Commerce Clause, the constitutional principle that stops states from placing excessive burdens on commerce between states.
Blocked for Now
- The duty to age-verify Utah residents who appear to be elsewhere because of a VPN
- Website liability for VPN-based workarounds
Still in Force
- Utah's original age-verification requirement for covered adult sites
- Ordinary VPN use, which was never restricted
A preliminary injunction isn't a final ruling. The case goes on, and Utah lawmakers have signaled they may rewrite the provision. Reports in October indicate the lawsuit itself is paused while that happens.
Why "Perfect Geolocation" Doesn't Exist
The core of the ruling is a technical fact that both sides agreed on: a website cannot reliably know where every visitor physically is. A site sees an IP address. It doesn't see your GPS, and it can't tell whether a person behind a VPN server in Denver is in Denver, Salt Lake City, or Singapore. Our explainer on IP geolocation vs. GPS covers why these are completely different signals.
VPN providers raised the same point while the bill was being debated. Detecting VPN traffic reliably at scale is an unsolved problem, so a law that makes sites liable for traffic they can't identify becomes what critics called a "liability trap." A site could either block every VPN user in the world, including millions of people using VPNs for ordinary security, or accept legal risk it has no way to manage.
Other States Are Watching
About 25 US states now have some form of age-verification law, including Texas, Florida, Arizona, Missouri, Georgia, South Dakota, and Ohio. Utah is the first to go after VPN workarounds explicitly, and other legislatures have been treating SB 73 as a test case. Outside the US, the UK, Australia, and Brazil are all debating the same "VPN loophole" question. Judge Barlow's reasoning, that you can't hold a site liable for location data that doesn't exist, will likely shape how those bills are drafted.
What It Means for Everyday VPN Users
- Your VPN is still legal. Nothing in SB 73 or the injunction changes that, in Utah or anywhere else in the US.
- Expect more "VPN detected" walls. Some sites may block VPN IP ranges entirely to stay out of legal trouble, which means more CAPTCHAs and blocks. Our guide to why VPNs trigger CAPTCHAs explains the mechanism.
- Age verification is a privacy risk in its own right. Uploading an ID or face scan to a third-party verifier creates a new data trail, and identity-verification companies have suffered breaches of their own.
- Pick a VPN that doesn't log. If politicians are going to keep circling VPNs, the provider you trust should keep as little data about you as possible. See what a real no-logs policy means.
Frequently Asked Questions
Is it illegal to use a VPN in Utah?
No. SB 73 places requirements on certain adult websites, not on VPN users or VPN providers. Using a VPN for privacy, security, or work is legal in Utah.
What did the federal judge block?
On September 24, 2026, Judge David Barlow preliminarily blocked the provision that required covered sites to age-verify Utah residents who mask their location with a VPN. Utah’s underlying age-verification law remains in effect.
Can a website tell where I am when I use a VPN?
A website sees your VPN server’s IP address, not your device’s GPS. That’s why the court found "perfect geolocation" impossible. A site can still learn your location from data you give it yourself, such as browser location permissions or account details.
Will other states copy Utah?
Several legislatures have been watching SB 73 as a test case. The injunction’s reasoning makes a straight copy less likely to survive in court, but expect revised versions.
Privacy That Stays Legal
CarrotVPN encrypts your connection with WireGuard® and keeps a strict no-logs policy. Free on Android, no account required.
Download CarrotVPN Free