For years, the pattern has been clear: age-verification mandates lead to a surge in **Virtual Private Network (VPN)** usage as users seek to maintain their privacy. Now, instead of rethinking these mandates, Utah lawmakers are targeting VPNs themselves. Next week, on May 6, 2026, Utah will implement a law that targets the use of VPNs to bypass age-verification gates. While similar provisions were successfully challenged in states like **Wisconsin**, Utah is proceeding with measures that could significantly impact digital privacy. ## What the Bill Does The "Online Age Verification Amendments," or **Senate Bill 73 (SB 73)**, was signed by Governor **Spencer Cox** on March 19, 2026. While the bill primarily focuses on a 2% tax on online adult content revenue, the section regulating VPN access is of immediate concern. ### The VPN Provisions Section 14 of the law amends existing Utah statutes in two key ways: 1. **Regulation based on physical location:** The law considers an individual to be accessing a website from Utah if they are physically located there, regardless of VPN usage. 2. **Ban on sharing VPN instructions:** Commercial entities hosting content deemed "harmful to minors" are prohibited from facilitating VPN use to bypass age checks. This creates a "liability trap" for websites. If a site cannot reliably detect a VPN user's true location, the legal risk could force them to either ban all known VPN IPs or mandate age verification for every visitor globally. ## "Don't Ask, Don't Tell" Unlike the **Wisconsin** proposal, **SB 73** doesn't explicitly ban VPNs. Instead, it discourages their use through liability and by restricting websites from sharing information about them. This raises First Amendment concerns, as it prevents platforms from providing truthful information about a lawful privacy tool. Under a "don't ask, don't tell" enforcement approach, websites likely only need to verify age if they know a user is in Utah and using a VPN. However, the broader obligation to police VPNs remains unclear. ### Technical Feasibility Blocking all known VPN and proxy IP addresses is a constant challenge. Providers add new IPs continuously, and no comprehensive blocklist exists. Complying with Utah’s requirements would be technically infeasible. The internet is designed to circumvent censorship. If Utah hampers commercial VPN providers, users will likely transition to non-commercial proxies or private tunnels. The collateral damage will affect businesses, journalists, and abuse survivors who rely on VPNs for data security. ## Uncharted Territory Lawmakers have seen age-verification mandates fail and are now targeting privacy tools. As the **Cato Institute** notes, attacking VPNs to enforce these regimes is a damaging approach. Attacks on VPNs are attacks on digital privacy. Regulators in countries like the **United Kingdom** and **France** are also considering VPN restrictions. As this law takes effect, we are entering uncharted territory, where lawmakers who misunderstand security tools are shaping the future of the internet.