A hot potato: Today marks a first for the US, one that won't be welcomed by most people: Utah has become the first state to target VPN use for age verification. The law was supposed to come into effect in May, but it was paused by a court injunction following a challenge from Pornhub parent company Aylo.
Utah's Online Age Verification Amendments, formally known as Senate Bill 73 (SB 73), differs from the age-verification laws of other US states and countries by specifically targeting VPN software as part of its rules.
As with similar legislation, SB 73 requires any commercial website on which more than one-third of its material is considered harmful to minors to implement reasonable age verification methods before granting access to users in Utah.
The big difference here is that the law states a user is considered to be accessing a website from the state if they are physically located there, regardless of whether they use a VPN, proxy server, or other means to disguise their geographic location. That means they still have to verify their age.
Any sites that fail to comply with the law face fines of up to $2,500 per violation. They are also prohibited from publishing instructions on how to use a VPN to circumvent the age-verification requirement.
The problem, of course, is that the law appears to assume websites can both detect VPN traffic and determine a visitor's true physical location with certainty, which they can't. At best, sites can block known VPN IP addresses, a constantly changing and incomplete list that will inevitably catch legitimate users while missing others entirely.
VPN provider Nord argued that complying with the law could have consequences far beyond Utah. Since affected adult websites cannot avoid the requirements simply by blocking users in the state, Nord said some operators may conclude that the only practical option is to verify the age of every visitor, including people in countries where no such requirement exists.
The company said that approach could force millions of users to undergo intrusive identity checks despite having no legal duty to do so, describing the legislation as a "liability trap."
The Electronic Frontier Foundation has also criticized the measure, warning that it could encourage websites to block traffic from known VPN addresses altogether. The digital rights group argues that the law puts sites in a difficult position by making them responsible for compliance while limiting what they can tell users about VPNs.
According to the EFF, those restrictions could also raise First Amendment issues by preventing websites from sharing accurate information about legal privacy tools with their users.
Nord said that the enforcement of SB 73 could be further delayed while litigation continues. It's also been emphasized that using a VPN is in no way being made illegal in the state: it's websites, rather than individual users, that face legal consequences for failing to comply.