On May 6, 2026, Utah’s amended Senate Bill 73 (SB 73), widely known as the Online Age Verification Amendments, goes into effect. The rules require websites publishing a “substantial portion of material harmful to minors” to mandate age verification for every visitor. What radically sets this new law apart from previous regulations in the sector is its direct crackdown on digital privacy tools. Online platforms will now bear full legal liability for allowing minors access to content, even if a user bypasses the age gate using a virtual private network.
The bill specifies that an individual is treated as a user accessing the site from within Utah as long as they are physically located in the state – regardless of whether they use IP-masking software like a VPN or proxy server. Additionally, the legislation strictly prohibits platforms from providing instructions on how to bypass verification using such software.
From a technical standpoint, the new law backs tech companies into a corner. The core purpose of VPN services is to mask a user’s actual location. As NordVPN representatives noted, reliably distinguishing Utah residents using proxy servers from the rest of the world is currently impossible. For this reason, the corporation describes the new legislation as a “liability trap” for businesses.
The Electronic Frontier Foundation (EFF), a digital rights group, is also raising alarms over the threats posed by SB 73. The organization’s analysis suggests that the technical inability to pinpoint locations will trigger drastic preemptive measures from companies terrified of lawsuits and financial penalties.
“If a website cannot reliably detect a VPN user’s true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally” – reads the EFF statement.
As a result, millions of internet users worldwide could face the invasive requirement of uploading ID scans or find themselves completely locked out of swaths of the web the moment they toggle on a VPN.
Utah has been at the forefront of the American legislative offensive for years – it was this very state that spearheaded the first wave of age verification laws, which immediately sparked a massive surge in demand for traffic-masking services in the region. The current law is an attempt to plug that loophole, but its uncompromising design creates a precedent targeting fundamental user privacy principles. Such drastic measures could eventually backfire on everyday users in Utah, who may lose access to VPNs altogether if companies decide to boycott the region over the aggressive legislation.