Breaking: Utah Law Imposes Liability on Websites for VPN-Bypassed Age Checks
Utah's Senate Bill 73, the Online Age Verification Amendments, takes effect on May 6, making the state the first in the U.S. to hold websites legally responsible when users employ VPNs to mask their location and circumvent age verification systems.
The law targets platforms that serve adult content, social media, or other age-restricted materials, requiring them to implement robust geo-location and age checks. If a user uses a VPN to appear to be outside Utah, the website can still be penalized for failing to block that user.
Background
Utah lawmakers passed SB 73 in March with broad bipartisan support, citing the need to protect minors from harmful online content. The bill amends existing age verification statutes to explicitly include VPN users.
Proponents argue that current age-gating tools are easily defeated by VPNs, which can cost as little as a few dollars per month. The law shifts the burden onto websites to detect and prevent such circumvention or face fines of up to $10,000 per violation.
Expert Reactions
“This is a seismic shift in internet regulation,” said Dr. Mara Chen, a digital privacy researcher at the University of Utah. “No other state has placed the compliance onus on websites for a user's choice to use a VPN.”
Industry groups, however, warn of unintended consequences. “Websites can't possibly detect every VPN connection without invasive tracking,” argued Jason Torres, a tech policy analyst at the Internet Freedom Coalition. “This law could force companies to block all Utah users just to avoid risk.”
What This Means
For websites, the law creates a new legal risk: they must either deploy advanced geo-verification technology that can identify VPN usage, or simply block access to all visitors who appear to be masked. Legal experts predict a wave of litigation over what constitutes “reasonable efforts.”
For Utah residents, the law may result in restricted access to legitimate content. VPN providers are not directly targeted, but their users in Utah could see many websites deny them service entirely. Privacy advocates worry about a chilling effect on free expression.
Utah's move could inspire copycat legislation in other states. “We're watching closely,” said state Senator Lisa Marston, a sponsor of the bill. “If this protects children, other states will follow.” But critics argue it sets a dangerous precedent for internet surveillance.
- Key Deadline: May 6, 2025 – law takes effect.
- Penalties: Up to $10,000 per instance of failure to block a VPN-masked minor.
- Enforcement: Utah Attorney General's office has yet to release compliance guidelines.