Utah’s latest push against online adult content has crossed a new line. Senate Bill 73, signed by Governor Spencer Cox on March 19, 2026, takes effect today, May 6. It marks the first time a U.S. state has explicitly targeted virtual private networks in age-verification mandates. Websites hosting more than one-third material harmful to minors must now verify ages for anyone physically in Utah. VPNs won’t help. The law deems users in-state regardless of proxies or location masking.
Sponsor Sen. Calvin R. Musselman framed it as child protection. But critics see overreach. The bill prohibits those sites from even sharing VPN instructions. Liability looms large. Fail to verify a masked Utah user, and face damages, fines up to $2,500 per violation, or injunctions from the Division of Consumer Protection. No safe harbor without compliance.
Technical reality bites hard. Blocking VPN traffic? A fool’s errand. Providers rotate IPs constantly. Residential proxies mimic home connections. As CNET reports, experts call it a ‘technical whack-a-mole’ no company can win. Sites might ban all known VPN addresses. Or worse: global age gates for everyone.
The Electronic Frontier Foundation warns of the fallout. ‘If a website cannot reliably detect a VPN user’s true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally,’ EFF deputy legal director Aaron Mackey said in an analysis. This subjects millions to invasive checks. Privacy evaporates.
NordVPN echoes the frustration. It’s a ‘technically unenforceable law’ that could expose users with no obligation to scrutiny, per PC Mag. Journalists. Abuse survivors. Business travelers. All collateral damage. VPNs shield against data brokers, hackers. Utah just painted them as loopholes.
This builds on Utah’s 2023 SB 287, which sparked Pornhub’s statewide block. Users turned to VPNs then. Searches spiked. Now lawmakers close that door. But enforcement? Murky ‘don’t ask, don’t tell.’ Sites liable only if they know. How? No clear method. First Amendment chills set in: no VPN tips allowed on covered sites, per Tom’s Hardware.
And the slippery slope steepens. Age gates started with porn. Now they ensnare tools of anonymity. Look to California. AB 1043 forces developers—even open-source ones—to query OS age signals before access. Indie coders on Linux? Impossible. No APIs there. Volunteer projects grind to halt in-state, as WebProNews details. Surveillance baked in. Free software choked.
Illinois SB 3977 eyes similar gates, potentially devouring open-source whole. Big Tech lobbies quietly. They dodge liability while states build the infrastructure. System76 called it out: these bills shield corporations, invite government eyes. Privacy? The real casualty.
Broader trends alarm. EFF predicts copycats. UK eyes VPN curbs. France mulls under-15 social bans. Federal whispers grow. A 2% tax on adult content revenues funds enforcement—$4 million allocated for 2027. Money flows to mental health accounts. But at what cost?
Users adapt. Tor surges in restricted zones. Cloud tunnels proliferate. Yet everyday folks suffer. VPN blocks hit remote workers, not just teens. Constitutional tests loom. Free speech. Anonymity. Interstate commerce. Wisconsin ditched a outright VPN ban. Utah didn’t.
One sentence sums it. Lawmakers chase kids online. They hand keys to a surveilled web. Utah leads. Others follow. Privacy hangs by a thread.
WebProNews is an iEntry Publication