Senate Bill 73 officially hits the books, but ongoing litigation and fierce pushback from major VPN providers leave the future of internet privacy in Utah hanging in the balance.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Utah has become ground zero for a major digital rights battle. Following months of intense legal wrangling, Utah’s Senate Bill 73 (SB 73) comes into effect today, September 3.
Originally scheduled for a May rollout, the law was temporarily paused following a court injunction. That initial pause has now expired, allowing the law to come into effect and making Utah the first US state to explicitly target VPN use for age verification mandates.
But the cybersecurity industry is warning that the legislation remains a convoluted, unenforceable mess.
As reported by Gizmodo, SB 73, formally known as the Online Age Verification Amendments, requires commercial websites hosting adult material to verify user ages.
The privacy concerns lie in how the state handles location spoofing: anyone physically located in Utah is legally treated as a Utah user, regardless of the IP address they present to a website.
This means if a resident of Salt Lake City connects to a VPN server in Germany, they are still a Utah user in the eyes of the law, and the website remains legally liable for verifying their age. If websites fail to comply, they face severe penalties reaching $2,500 per violation.
NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.
Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.
To comply with the law, websites may be forced to use highly intrusive tracking measures or block all suspected VPN traffic. Furthermore, adult websites are now legally barred from publishing instructions on how to use a VPN to circumvent the state's age gates.
Digital rights groups have previously slammed the framework as an "impossible by design" waste of money that simply creates a technical whack-a-mole. This legislative push isn't happening in a vacuum, as authorities globally, including the EU, increasingly view VPNs as circumvention software that needs to be restricted.
However, some of the best VPNs are refusing to alter their services for Utah residents, noting that the legal burden falls entirely on website operators.
Speaking exclusively to TechRadar, Laura Tyrylyte, privacy advocate at NordVPN, clarified that the September 3 rollout is far from final. "The legal challenge to the law is still ongoing, so September 3 should not be treated as a set enforcement date. Depending on how things move, enforcement could remain paused while litigation continues," Tyrylyte explained.
"That said, SB 73 does not affect NordVPN directly as the law's obligations fall on websites that host content deemed harmful to minors, not on VPN providers," she continued. "However, the trend of rushed-out laws that are impossible to comply with is far from reassuring, and we will continue to advocate for approaches to child safety that don't sacrifice the cybersecurity and privacy tools that protect everyone."
