- Utah’s SB 73 takes effect today, September 3, but ongoing legal challenges mean strict enforcement could remain paused.
- Anyone physically in Utah is legally treated as a resident, even if they use a VPN to mask their location, and websites face a $2,500 penalty per violation.
- Leading VPN providers confirm they will not change how their services operate in Utah, calling the legislation a "dangerous precedent" that fails to solve age assurance.
Utah has become ground zero for a major digital rights battle. Following months of intense legal wrangling, Utah’s Senate Bill 73 (SB 73) comes into effect today, September 3.
Originally scheduled for a May rollout, the law was temporarily paused following a court injunction. That initial pause has now expired, allowing the law to come into effect and making Utah the first US state to explicitly target VPN use for age verification mandates.
But the cybersecurity industry is warning that the legislation remains a convoluted, unenforceable mess.
As reported by Gizmodo, SB 73, formally known as the Online Age Verification Amendments, requires commercial websites hosting adult material to verify user ages.
The privacy concerns lie in how the state handles location spoofing: anyone physically located in Utah is legally treated as a Utah user, regardless of the IP address they present to a website.
This means if a resident of Salt Lake City connects to a VPN server in Germany, they are still a Utah user in the eyes of the law, and the website remains legally liable for verifying their age. If websites fail to comply, they face severe penalties reaching $2,500 per violation.
NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.
Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.
📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.
A "dangerous precedent" for privacy tools
To comply with the law, websites may be forced to use highly intrusive tracking measures or block all suspected VPN traffic. Furthermore, adult websites are now legally barred from publishing instructions on how to use a VPN to circumvent the state's age gates.
Digital rights groups have previously slammed the framework as an "impossible by design" waste of money that simply creates a technical whack-a-mole. This legislative push isn't happening in a vacuum, as authorities globally, including the EU, increasingly view VPNs as circumvention software that needs to be restricted.
However, some of the best VPNs are refusing to alter their services for Utah residents, noting that the legal burden falls entirely on website operators.
Speaking exclusively to TechRadar, Laura Tyrylyte, privacy advocate at NordVPN, clarified that the September 3 rollout is far from final. "The legal challenge to the law is still ongoing, so September 3 should not be treated as a set enforcement date. Depending on how things move, enforcement could remain paused while litigation continues," Tyrylyte explained.
"That said, SB 73 does not affect NordVPN directly as the law's obligations fall on websites that host content deemed harmful to minors, not on VPN providers," she continued. "However, the trend of rushed-out laws that are impossible to comply with is far from reassuring, and we will continue to advocate for approaches to child safety that don't sacrifice the cybersecurity and privacy tools that protect everyone."
AdGuard VPN has taken a similar stance. Denis Vyazovoy, Head of Products at AdGuard, confirmed to TechRadar that the company has no intention of restricting its local users.
“We don’t currently see Utah’s SB 73 as creating direct compliance obligations for VPN providers, so we don’t plan to change how AdGuard VPN works for users in Utah," Vyazovoy said. "More broadly, treating VPNs as a loophole in age-verification policy sets a dangerous precedent: VPNs are general-purpose privacy and security tools, and restricting them risks harming legitimate users without solving the underlying problem of age assurance.”
Gytis Malinauskas, Head of Legal at Surfshark, told TechRadar that Utah's SB 73 sets a concerning precedent. "In practice, it requires sites that host content deemed harmful to minors to block VPNs. This treats a core cybersecurity tool as a loophole. VPNs are a standard security tool millions of Americans use every day to protect their data. Blocking them would only erode the privacy of ordinary users," he said.
For now, everyday encryption remains completely legal in Utah. However, as the burden of proof shifts to website operators, users can expect to face significantly more invasive identity checks, or blanket blocklists, as companies attempt to navigate the new state rules.
