Utah, USA, has extended age verification requirements for content targeting minors to VPN usage scenarios, becoming the first state to directly incorporate such evasion methods into its state law. According to the new regulations, if a website contains a significant proportion of adult content, even if visitors use VPN or proxy servers to hide their location, operators are still required to determine whether they are actually in Utah and to complete age verification.

SB Write 73 VPN into the restrictions

According to SB, if a commercial website knowingly and intentionally publishes content that is harmful to minors, and such content accounts for more than one-third of the total content on the website, then the website is required to perform age verification for visitors located in Utah. The law also specifies that whether users utilize VPN, proxy servers, or other tools to conceal their location does not change their classification as "Utah users."

This means that websites cannot process access requests based solely on superficial IP information, but must assume a greater responsibility for identifying the actual geographical location. For operators, both the difficulty of compliance and legal risks increase as a result.

Websites must not provide means to bypass guidelines.

The new law also prohibits relevant websites from assisting users in bypassing age verification, including providing instructions on how to use VPN to access websites and how to circumvent geographical blocks. State consumer protection departments can impose an administrative fine of up to $2,500 for each violation, and courts can also impose civil penalties of the same amount, along with other remedial measures.

• Administrative fines: Up to $2,500 per violation
• Civil penalties: The court may impose a fine of up to $2,500 per violation.
• Data requirements: After verification is completed, no identity identification information shall be retained.

Providers of verification services are also subject to these constraints. By law, verification service providers are not allowed to continue to store information that can identify individuals after granting access. If the operator adopts a verification method that complies with state regulatory requirements, it may be considered as meeting the age verification requirements.

Privacy groups raise constitutional concerns

Privacy company Nym stated on the X platform that SB 73 not only restricts access methods but also touches upon the public expression of privacy tools. The company believes that prohibiting websites from publishing information related to bypassing age verification for VPN may trigger disputes at the level of the First Amendment of the U.S. Constitution.

Similar debates have emerged in multiple countries before. In September 2024, Brazil investigated users who were using VPN to bypass temporary bans on X; in July 2025, after the age verification measures took effect in the UK, local demand for VPN surged for a time. France also discussed restricting minors from using VPN to circumvent age controls earlier this year, but did not pursue a comprehensive ban.