Utah has become the first state to pass legislation that makes websites legally responsible when users employ VPNs to disguise their location and circumvent age verification measures. The Online Age Verification Amendments, formally known as Senate Bill 73, take effect on May 6. This law marks a significant shift in how states handle online age restrictions, directly targeting the use of location-masking tools. Below, we answer key questions about this pioneering regulation.
What exactly is Utah’s Senate Bill 73?
Senate Bill 73, or the Online Age Verification Amendments, is a Utah law that mandates websites to implement age verification systems for users accessing content that is restricted to adults. The law is unique because it holds the website liable if a user uses a Virtual Private Network (VPN) or other location-spoofing technology to bypass these age checks. It essentially requires sites to take reasonable steps to prevent underage access, even when users try to hide their true location. The bill was designed to strengthen protections for minors online, particularly for platforms offering adult content, gambling, or other age-gated material.
When does SB 73 go into effect?
The law goes into effect on May 6. Website operators had a short window—from the bill’s passage to May 6—to update their systems and compliance measures. Any platform that fails to adhere to the new requirements after that date could face legal penalties. This rapid implementation has caught many tech companies off guard, as they scramble to adjust their age verification protocols and VPN detection capabilities. The effective date is firm, meaning no additional grace period has been granted, so sites must be ready by day one.
Why did Utah pass this law?
Utah lawmakers were motivated by growing concerns about minors accessing age-restricted content online, such as pornography, gambling sites, and other adult material. Despite existing age verification laws, many children circumvented checks by using VPNs to mask their IP addresses and appear to be in states or countries with fewer restrictions. This loophole made traditional location-based verification ineffective. SB 73 closes that gap by placing the burden on websites to detect and prevent VPN-assisted bypass attempts. Supporters argue it’s a necessary step to protect youth, while critics warn it could lead to overreach and privacy violations.
How does SB 73 specifically target VPN use?
The law explicitly states that a website cannot avoid liability simply because a user employed a VPN or proxy to hide their location. If a site knows or should have known that a user is using such tools to evade age verification, the site must take action—such as blocking access or demanding alternative proof of age. This means platforms now have to implement VPN detection systems, like IP blacklists or browser fingerprinting, to identify potential spoofing. Failure to do so can result in the site being held responsible for allowing underage users to access restricted content, even if the user took steps to deceive the system.
What are the penalties for websites that don’t comply?
While specific penalty amounts are detailed in the bill, the law generally allows for civil liability. That means a website could face lawsuits from the state or private parties if it fails to prevent VPN-bypassed access to age-restricted content. In addition, non-compliant websites may be subject to injunctions or orders to cease operations in Utah until they meet the requirements. The exact fines vary depending on the severity and frequency of violations. This legal exposure is a strong incentive for sites to invest in robust verification technology, even if it means additional costs and technical challenges.
How does this law affect ordinary internet users?
For most Utah residents, the law will mean more friction when trying to access age-restricted sites. Even if they are adults, they may be asked to submit government-issued ID or use third-party verification services—even if they are not using a VPN. This is because platforms will likely apply uniform verification to all users to avoid liability. Privacy advocates raise concerns about the amount of personal data being collected and stored by these verification systems. Additionally, users who rely on VPNs for legitimate privacy or security reasons could find themselves blocked from entire categories of content, even if they are not trying to hide their age.
Could other states follow Utah’s lead?
Yes, experts suggest that Utah’s SB 73 could serve as a template for other states seeking to strengthen age verification laws. Several states, including Texas and Arkansas, have already considered similar bills. The key difference is Utah’s explicit focus on holding websites liable for VPN use, which adds a new layer of enforcement. If the law proves effective and withstands potential legal challenges—such as those based on the First Amendment or privacy rights—other legislatures may quickly adopt comparable measures. Tech companies are watching closely, as a patchwork of state laws could force them to adopt national age verification standards.