Utah is testing new ground in the digital rights battle, becoming the first state to directly target VPN use for age verification. The state will now require websites that host adult material to verify visitors' ages even when VPNs hide their location, putting operators on the hook for determining whether users are physically inside the state.

Under Utah's SB 73, commercial websites that "knowingly and intentionally publish or distribute material harmful to minors" must verify Utah visitors' ages when that material exceeds one-third of their content—even if visitors conceal their location with VPNs or proxies.

"A commercial entity that operates a website that contains a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements," the bill said.

Under the law, visitors physically in Utah count as Utah users regardless of whether they use a virtual private network, proxy server, or another tool to disguise their location. VPNs route traffic through remote servers, concealing the IP address a website would otherwise see.

The bill also restricts operators from helping visitors bypass age checks, including by providing instructions for accessing their websites through VPNs or evading geographic blocks.

🇺🇸 Utah's SB 73 bans websites from publishing instructions on how to use a VPN to bypass age verification. Publishing information about how VPNs work is now illegal in Utah if it relates to age verification. The law restricts speech about a privacy tool. That is a First… pic.twitter.com/1cOar6zX36 — Nym (@nym) September 3, 2026

🇺🇸 Utah's SB 73 bans websites from publishing instructions on how to use a VPN to bypass age verification.

Publishing information about how VPNs work is now illegal in Utah if it relates to age verification.

The law restricts speech about a privacy tool.

That is a First… pic.twitter.com/1cOar6zX36

— Nym (@nym) September 3, 2026

The Division of Consumer Protection can impose administrative fines of up to $2,500 per violation, while courts can impose civil penalties of up to $2,500 per violation alongside other remedies.

The statute also prohibits verification providers from retaining identifying information after granting access. Operators using verification methods that meet standards established by division rules are deemed compliant with the age-verification requirements.

Utah's move builds on a broader wave of state-level age-verification laws. Roughly two dozen states have enacted similar requirements for adult sites in recent years, and in June 2025 the U.S. Supreme Court upheld Texas's age-verification law in Free Speech Coalition v. Paxton, rejecting a First Amendment challenge from the adult industry. That ruling has emboldened states to expand such mandates, and Utah's extension of liability to VPN-cloaked visitors marks a new frontier in how far those obligations reach.

Privacy company Nym argued on X that SB 73's prohibition on covered websites providing VPN instructions to bypass age checks restricts speech about privacy tools.

"The law restricts speech about a privacy tool," the company wrote. "That is a First Amendment question the courts have not answered yet."

Nym's founder Harry Halpin told Decrypt that, "Any law to make VPNs illegal restricts the freedom of information, and freedom of information is fundamental to freedom of speech," arguing that Utah's statute is "almost certainly" unconstitutional.

SB 73 is the latest action by regulators targeting VPNs both to enforce platform bans and to stop users bypassing age checks. While Paxton addressed the core age-verification mandate, the specific question of whether a state may bar websites from telling users how VPNs work—or hold operators responsible for identifying physically present users despite IP concealment—remains untested, leaving the law's practical enforceability an open question.

In September 2024, Brazilian authorities began investigating users suspected of using VPNs to evade the country's temporary ban on X, with potential fines approaching $9,000 a day.

In July 2025, UK VPN demand surged more than 6,000% as age checks took effect.

"The reason there's an increase is because the UK passed an ill-thought-out Online Safety Bill," Nym CEO and co-founder Halpin told Decrypt at the time.

Nym, which operates a decentralized VPN service, saw its NYM token climb 12% during the surge, a day after launching its iOS app.

In February, France considered restricting minors' use of VPNs to bypass age controls, while officials ruled out an outright ban.