• Utah to hold firms liable for failing to age-verify users, even if they use VPN
• Senate Bill 73 is set to take effect on May 6, 2026
• Digital rights group warns that targeting VPNs is a "technical whack-a-mole"

Utah lawmakers are about to enforce a controversial new law that privacy experts are warning could fundamentally break the internet's architecture of anonymity.

Set to take effect on May 6, 2026, the state’s Online Age Verification Amendments, formally known as Senate Bill 73, will require adult websites to enforce strict age checks on anyone physically located in Utah.

Crucially, companies will remain liable even if a visitor uses a VPN service to spoof their geographic location.

This marks the first time a US state will rule out legislation that directly targets the use of a VPN to bypass legally mandated age gates.

While a recent push in Wisconsin to ban VPNs was scrapped due to heavy backlash, Utah's legislation survived and is now drawing fierce criticism from civil liberties groups and tech companies alike.

A complete misunderstanding of security

Under SB 73, signed into law by Governor Spencer Cox on March 19, 2026, a user is considered to be accessing a website from Utah if they are physically there, regardless of any proxy server or VPN masking their IP address.

The law also takes aim at information sharing. It prohibits commercial entities hosting a "substantial portion of material harmful to minors" from providing any instructions on how to use a VPN to circumvent these checks.

While it stops short of an outright ban on using a VPN, the Electronic Frontier Foundation (EFF) warns that the mandate is built on a "don't ask, don't tell" style of enforcement.

The EFF also argues that preventing platforms from sharing basic, truthful information about a lawful privacy tool raises massive constitutional concerns regarding free speech.

Backlash is also coming from the VPN industry. Back in March, NordVPN strongly condemned the bill, telling TechRadar that blocking all known VPN and proxy IPs is "technically impossible."

Because no comprehensive blocklist exists, the EFF echoed that the requirement is simply a "technical whack-a-mole that likely no company can win."

NordVPN argues that the law creates an "unresolvable compliance paradox" for responsible operators. Instead of protecting minors, the company warned that the legislation will "simply punish lawful users who care about their privacy, globally." Ultimately, NordVPN states: "It is a liability trap."

By effectively holding websites liable for the actions of users masking their locations, the legal risk may push platforms to adopt blanket age checks for all internet traffic. As the EFF notes, this would force regular citizens to hand over their data to brokers and third-party verification tools.

A global war on anonymity

Utah's crackdown is not an isolated incident. Across the globe, lawmakers are increasingly treating VPNs not as critical security tools, but as obstacles to online regulation.

In the UK, the government recently confirmed it may "age restrict or limit children's VPN use" following a three-month consultation designed to "close loopholes that put children at risk."

Ultimately, privacy experts are deeply concerned that this global push will normalize mass surveillance.

Andy Yen, CEO of Proton, recently warned that "age verification as is currently being proposed in country after country would mean the death of anonymity online."