Utah has become the first state in the United States to prohibit residents from using virtual private networks to circumvent age verification requirements online. Senate Bill 73, signed into law this week, holds websites legally liable when users mask their Utah-based location to access age-restricted content - effectively treating any connection routed through a Utah VPN address as a connection physically originating within the state. The law is narrow in its stated purpose but sweeping in its potential consequences.
What the Law Actually Does - and Why It's Complicated
On its face, SB 73 is an extension of Utah's existing push to shield minors from online content deemed harmful. The logic is straightforward: if age verification is the barrier, and a VPN allows users to slip past that barrier by obscuring their location, then VPN-assisted access becomes an act the state now considers legally meaningful. Websites that fail to catch such users - or that knowingly permit access - bear the liability.
The technical reality is considerably messier. VPNs are not exclusively tools of evasion. They are widely used by remote workers, journalists, privacy-conscious individuals, and people in professions that require encrypted communication. Expecting a website operator to reliably distinguish between a Utah resident using a VPN to watch a restricted video and a cybersecurity professional conducting routine encrypted traffic is not a simple engineering problem - it may not be a solvable one at all.
The Electronic Frontier Foundation has outlined the most likely outcome: faced with the impossibility of precisely identifying VPN users by state, websites will take the path of least legal exposure. That could mean blocking all known VPN IP addresses outright, or defaulting to mandatory age verification for every visitor globally - regardless of location. Either outcome extends the law's reach far beyond Utah's borders, affecting users who have no connection to the state and never intended to circumvent anything.
A Patchwork of State Laws With National and Global Fallout
Utah is not acting in isolation. Wisconsin and Michigan have both introduced similar legislation, suggesting a pattern of state-level attempts to regulate online access that will, if continued, produce a fragmented legal landscape for any platform operating nationally. Because the internet does not respect state lines, a website that must comply with Utah's VPN law cannot limit that compliance to Utah alone. The infrastructure adjustments required to satisfy one state's rules will inevitably affect all users.
Internationally, the trajectory is familiar. Australia enacted age verification requirements for certain online content categories, legislation that Wikipedia's founder Jimmy Wales publicly described as an unmitigated disaster. The United Kingdom introduced its own measures, with reports quickly emerging of children finding rudimentary workarounds - drawing mustaches on themselves to defeat facial age-estimation tools. The gap between legislative intent and practical enforcement has proven wide in both cases. Utah's law adds a new dimension by targeting the workaround itself rather than simply the access point, but the underlying enforcement challenge remains unresolved.
Privacy Architecture and the Limits of State Power
The Electronic Frontier Foundation's concern goes beyond the inconvenience to individual users. The organization argues that by treating VPN use as presumptively suspicious - or outright prohibited in this context - Utah is establishing a legal framework that treats privacy infrastructure as an obstacle to government oversight rather than a feature of a functioning internet. VPNs are part of the foundational architecture of secure communication. Once one state defines their use as legally consequential in ways that create liability for third parties, others can build on that precedent.
The EFF's warning that Utah is "setting a precedent that prioritizes government control over the fundamental architecture of a private and secure internet" is not hyperbole in a legal context. Precedents in state law travel. If SB 73 survives legal challenge and is seen to function - even imperfectly - it provides a template. The question of whether minors should be protected from harmful online content is not genuinely contested. The question of whether this law achieves that goal without dismantling tools that serve legitimate privacy interests for millions of adults is very much open.
What Utah has done is force a confrontation that was eventually coming: between the internet's original design, which assumed relatively anonymous, borderless access, and the growing desire of governments to impose geographic and demographic control over what users can reach. That confrontation will not be settled by one state law. But it has now formally begun.
