Utah’s VPN-related age-verification provisions are scheduled to take effect on May 6, 2026, treating visitors physically in the state as accessing covered websites from Utah even when a VPN or proxy makes their connection appear to come from elsewhere.
Governor Spencer Cox signed Senate Bill 73, the Online Age Verification Amendments, on March 19. The measure also prohibits covered website operators from facilitating or encouraging the use of VPNs, proxies or other means to circumvent age-verification requirements.
VPN provider NordVPN and the Electronic Frontier Foundation have criticized the provisions, arguing that difficulty determining visitors’ physical locations could expose operators to legal risk and encourage broader age checks or VPN blocking.
What the provisions require
Section 14 amends Utah’s age-verification statute to make physical location the basis for determining whether someone is accessing a covered website from the state. Using a VPN, proxy server or another method to disguise that location does not change how the visitor is classified.
The restrictions on assisting circumvention apply to commercial entities operating websites containing a substantial portion of material harmful to minors. They cover providing instructions on using VPNs or proxies to access the website, as well as providing ways for people in Utah to circumvent geographic blocking.
The measure does not ban VPN use outright. EFF interprets it as likely requiring websites to request proof of age when they learn that a VPN user is physically in Utah. The organization says operators’ broader obligation to identify such users remains unclear.
The limits of location detection
A VPN routes requests through an intermediary server, whose IP address is visible to the destination website. Locating that address does not, by itself, establish where the person using the VPN is physically located.
IP-geolocation provider MaxMind explains that its services can locate a proxy’s IP address without determining the location of the person behind it. The company also says residential proxies, which route requests through residential internet connections, can be difficult to detect.
Detection databases can flag some VPN and proxy infrastructure, but the classifications have limits. MaxMind’s documentation says that when VPN providers do not register address ranges under names associated with their services, its database may identify those ranges only as belonging to a hosting provider.
Network administrators can use firewalls with deep packet inspection to identify VPN traffic passing through their networks. That visibility differs from the requests a destination website receives after traffic has passed through a VPN server.
Compliance and privacy concerns
NordVPN argues that changing server addresses and the absence of a comprehensive blocklist make complete VPN blocking technically unworkable. The company said of the legislation: “It is a liability trap.”
EFF warns that the legal risk could push covered websites to block known VPN addresses or require age verification from visitors worldwide. NordVPN has also warned that operators could extend checks beyond Utah because an apparent location outside the state does not establish that a visitor is elsewhere.
EFF says restrictions on commercial VPN services could affect businesses, journalists and survivors of abuse who use them for data security. Its concerns include the potential impact on adults using privacy tools for lawful purposes.
The debate follows a similar dispute in Wisconsin, where lawmakers removed a VPN-blocking provision from age-verification legislation.
