Utah's newest age verification law goes live on 6 May, and it is doing something no US state has tried before. Lawmakers are no longer just targeting adult websites. They are targeting the privacy tools people use to get around them.
What is being tested in Utah is not simply whether minors can be blocked from porn sites, but whether anonymous browsing itself can survive the next wave of internet regulation.
Utah lawmakers also imposed a 2% tax on porn websites and hefty fines for violating age-verification requirements.
A New Age-Gating Law Circumvented by VPN
Senate Bill 73, formally titled the Online Age Verification Amendments, requires websites hosting a 'substantial portion of material harmful to minors' to verify the age of users accessing those platforms from Utah.
Sponsored by Sen. Calvin Musselman (R) and Rep. Steve Eliason (R), age-gating laws are not new. Several US states have introduced similar requirements, prompting major adult sites such as Pornhub to block access in protest rather than collect sensitive identification data.
Users, predictably, found the workaround quickly. VPNs.
A virtual private network masks a user's IP address and routes traffic through another location, making a Utah resident appear to be browsing from Nevada, Canada or virtually anywhere else. That technical dodge has undermined state-by-state age verification efforts for months.
Utah's answer is unusually blunt. Under SB 73, a user is legally considered to be accessing a website from Utah if they are physically in Utah, regardless of whether they are using a VPN, proxy server or any other tool designed to disguise location. Covered sites are also barred from offering instructions on how to use VPNs to bypass checks.
The Liability Trap of Utah's New Age-Gating Law
This is the core problem critics keep returning to. A VPN is specifically built to conceal where a user is connecting from.
If a website sees traffic arriving from a server in Switzerland, or New York, or Amsterdam, it has no reliable technical method of determining whether the person behind that connection is secretly sitting in Salt Lake City.
Yet Utah's law places liability on the website, not the user.
NordVPN has described that as an 'unresolvable compliance paradox' and a 'liability trap', warning that platforms are now being held responsible for identifying people who are deliberately built to be unidentifiable online.
The Electronic Frontier Foundation has gone further, arguing that the wording leaves adult sites with two legally safer choices, neither of them reassuring. They can ban all known VPN traffic outright, or they can impose age verification on every visitor globally to reduce the chance of being sued by Utah regulators.
A statute drafted for one conservative state could end up forcing identity checks on millions of adults nowhere near Utah, simply because websites may decide broad surveillance is easier than technical guesswork.
Privacy Advocates See a Much Bigger Fight Emerging
Utah officials frame SB 73 as a child safety measure, but critics see a precedent.
The concern is not that VPNs are being criminalised outright but residents can still download and use them. The more serious issue is that lawful privacy software is now being treated as suspicious infrastructure that websites must work around or neutralise.
Ordinary users use them because they do not want every browsing session exposed to advertisers, data brokers or insecure public networks. Folding those users into an adult-content enforcement net creates collateral damage that lawmakers appear willing to ignore.
Online reaction has reflected that disbelief. Across privacy and VPN forums, users have repeatedly asked the same practical question: how can websites be expected to verify the physical location of masked traffic without simply punishing every masked visitor? The consensus is not that the law is clever, but that it misunderstands how modern web privacy works and may push platforms toward blanket restrictions.
That cannot be dismissed as tech industry exaggeration. Once websites begin treating VPN users as legal risk rather than routine traffic, the pressure to demand more personal data from everyone becomes much harder to contain.
Utah May Be First, But It Is Unlikely To Be Last
SB 73 takes effect this week, making Utah the first state to explicitly legislate against VPN-based age gate avoidance. That alone guarantees national attention. Legislators elsewhere are already pursuing broader age verification models, and Utah has now supplied a template for going after the bypass tools next.
What makes this striking is the direction of travel. Age verification began as a debate over porn access for minors. It is now becoming a test case for whether adults can still browse privately without handing over identity documents or being blocked for using standard security software.
Originally published on IBTimes UK
© Copyright IBTimes 2025. All rights reserved.
