Utah's SB 73: How the New VPN Law Could Affect Online Privacy

Utah is set to implement a groundbreaking law next week that directly targets VPN usage in an effort to enforce age verification for adult content. While similar legislative attempts have failed in other states due to privacy and constitutional concerns, Utah's Senate Bill 73 (SB 73) is moving forward, raising alarm among digital rights advocates. Critics argue the law creates a 'liability trap' that could push websites to impose blanket age checks or block VPN users worldwide. Here’s a breakdown of the key questions surrounding this controversial legislation.

What is Utah's SB 73 and when does it take effect?

Senate Bill 73, officially called the 'Online Age Verification Amendments,' was signed by Governor Spencer Cox on March 19, 2026. The law has two main components: a section regulating VPN access that goes into effect on May 6, 2026, and a 2% tax on revenues from online adult content taking effect in October 2026. The VPN provisions are the most immediate focus, as they make Utah the first state in the U.S. to explicitly criminalize the use of VPNs to bypass age-verification gates. Under the law, commercial entities hosting material deemed harmful to minors face new obligations, including verifying the physical location of users—even if they use a VPN. Failure to comply could result in legal liability, pushing platforms to adopt aggressive enforcement measures.

How does SB 73 specifically target VPN usage?

The law addresses VPNs in two key ways. First, it redefines how a user's location is determined: even if someone uses a VPN, proxy, or other tool to mask their geographic location, they are still legally considered to be accessing the internet from their actual physical location—i.e., Utah. Second, it prohibits commercial entities that host a substantial amount of content harmful to minors from facilitating or encouraging the use of VPNs to skirt age checks. This includes providing instructions on how to use a VPN or offering tools to bypass geofencing. Essentially, the law attempts to nullify the privacy benefits of VPNs for users in Utah while placing the burden on websites to detect and verify a user's true location, regardless of their digital disguise.

Why does the EFF call this a 'liability trap'?

The Electronic Frontier Foundation (EFF) warns that SB 73 creates a massive liability trap for websites. Since many platforms cannot reliably detect a VPN user's actual location, they face a difficult choice: either attempt to verify the age and location of every visitor globally—which is impractical and invasive—or ban all known VPN IP addresses outright. Either option harms users worldwide. For example, a site might block VPN connections entirely, affecting not just Utah residents but also users in other states and countries who rely on VPNs for privacy, security, or censorship circumvention. Even if a site tries to comply, the legal risk of mistakenly allowing a Utah-based VPN user through could lead to costly lawsuits. This chilling effect, the EFF argues, undermines digital privacy on a global scale.

How is Utah's law different from the failed Wisconsin proposal?

Wisconsin had a similar bill that targeted VPNs for bypassing age verification, but it was withdrawn after widespread opposition over constitutional and technical flaws. Utah's SB 73 differs in that it stops short of an outright VPN ban—it does not make VPN use itself illegal. Instead, it shifts the responsibility to commercial websites, requiring them to verify the physical location of users and prohibiting them from assisting VPN use to avoid age gates. This approach is more indirect but potentially more far-reaching, as it puts the onus on platforms rather than individuals. However, in practice, the result may be similar: websites may block VPNs entirely or impose invasive identity checks to avoid legal jeopardy, effectively punishing all users—not just those in Utah.

What global consequences could this law have?

Because the internet is borderless, a law in one state can have ripple effects worldwide. Under SB 73, a website that cannot perfectly determine whether a visitor is using a VPN from Utah may decide to impose age verification on every user, or simply block all VPN traffic. This would affect millions of internet users beyond Utah—journalists, activists, and ordinary people in countries where VPNs are essential for basic privacy or to bypass government censorship. The law also sets a precedent: other states or countries might model similar legislation, leading to a patchwork of inconsistent rules that fragment the internet. Digital rights groups fear that this could normalize the idea that using a VPN to protect identity is suspicious, even when no illegal activity is involved.

What is the 2% tax on adult content revenue?

In addition to the VPN provisions, SB 73 includes a 2% tax on revenues generated from online adult content, set to take effect in October 2026. This tax applies to commercial entities that host or distribute material considered harmful to minors. While the tax itself is not directly about VPNs, it is part of the same legislative package aimed at regulating adult content. Critics argue that the tax could further incentivize platforms to over-censor content or implement age verification systems that compromise user privacy. Combined with the VPN restrictions, the tax creates a layered regulatory environment that could make it financially and legally risky for sites to operate without aggressive user screening, impacting not just adult content but also any platform that might host user-generated material.

Why are privacy advocates concerned?

Privacy advocates, including the EFF, are deeply worried that SB 73 undermines fundamental digital rights. By targeting VPNs, the law discourages the use of tools that protect online anonymity—a key defense against surveillance, data collection, and censorship. The requirement for websites to verify the physical location of all users, even those using VPNs, effectively demands that platforms either break VPN functionality or engage in mass age verification, which often involves collecting sensitive personal information like government ID. This could chill free expression and access to information. Moreover, the law risks normalizing the idea that privacy tools are inherently suspicious, which could lead to broader crackdowns on encryption and anonymity technologies. In an era of increasing digital surveillance, advocates see SB 73 as a dangerous step backward.

As Utah's law goes into effect, the debate over digital privacy versus child protection continues. For more details on the legal implications, see our explanation of the liability trap.