The state of Utah has become the first US jurisdiction to make websites legally responsible for users who bypass age-verification gates using virtual private networks (VPNs). Senate Bill 73, which went into effect on May 6, 2026, treats anyone physically located in Utah as a Utah user, regardless of their IP address. This means that platforms must now age-verify any user they suspect is physically present in the state, even if their IP address suggests otherwise.
The law has significant implications for adult-industry platforms and operators, who are already grappling with the complexities of age verification. The Free Speech Coalition (FSC) has warned that compliance with SB 73 will be "difficult, if not impossible," due to the imperfect nature of geolocation based on IP addresses.
What Happened
Senate Bill 73 was signed into law by Governor Spencer Cox on March 19, 2026. The bill updates Utah's existing age-verification mandate and gives the Division of Consumer Protection the ability to enforce it. One key provision of SB 73 is that platforms are now prohibited from publishing instructions on how to use a VPN to bypass age checks.
The law also introduces a new concept: treating anyone physically located in Utah as a Utah user, regardless of their IP address. This means that platforms must now consider the physical location of users when determining whether they need to be age-verified. As the Electronic Frontier Foundation (EFF) notes, this is a "technical whack-a-mole" that will require platforms to develop new strategies for compliance.
Background and Context
Utah's SB 73 is part of a broader trend towards stricter age-verification laws in the US. Several states have passed legislation requiring platforms to verify the age of users accessing adult content, including Louisiana, Mississippi, Arkansas, and Virginia. However, these laws often present compliance challenges for platforms due to their reliance on IP addresses.
IP-based geolocation is imperfect, as it can be easily manipulated by VPNs or other tools. This means that platforms may struggle to determine the physical location of users, even if they are using a VPN. As the EFF notes, this creates a "liability trap" for platforms, which must now consider the possibility of being held liable for users who bypass age checks.
Why it Matters to the Industry
The implications of SB 73 are significant for adult-industry platforms and operators. The law requires platforms to develop new strategies for compliance, including potentially blocking all known VPN traffic or age-gating everyone on a Utah-shaped IP envelope. This will require significant investments in technology and resources.
Furthermore, the law introduces a new risk factor for platforms: the possibility of being held liable for users who bypass age checks. As the EFF notes, this creates a "bounty" system where individual citizens can sue platforms out of their own pocket, with potentially devastating consequences for small businesses.
What Comes Next
The FSC has warned that compliance with SB 73 will be challenging due to the imperfect nature of geolocation based on IP addresses. The organization is working with Utah officials to determine whether website compliance is possible through the state's digital ID provider, but so far, no solution has been found.
As a result, many platforms are likely to block traffic from Utah or age-gate everyone on a Utah-shaped IP envelope. This will have significant implications for adult-industry businesses operating in the state, who may struggle to comply with the law due to its complexity and ambiguity.
Key Facts
- Senate Bill 73 went into effect on May 6, 2026, making Utah the first US jurisdiction to make websites legally responsible for users who bypass age-verification gates using VPNs.
- The law treats anyone physically located in Utah as a Utah user, regardless of their IP address.
- Platforms are now prohibited from publishing instructions on how to use a VPN to bypass age checks.
- The law introduces a new concept: treating anyone physically located in Utah as a Utah user, regardless of their IP address.
- The FSC has warned that compliance with SB 73 will be "difficult, if not impossible," due to the imperfect nature of geolocation based on IP addresses.
