On March 19, 2026, Utah Governor Spencer Cox signed Senate Bill 73 into law. It went into effect May 6. It is currently on hold until September 3 following a legal challenge. And it is the most significant piece of VPN-specific legislation ever passed in the United States.
This is not a law that bans VPNs. But it does something almost as consequential: it makes websites legally responsible for what their users do with a VPN.
Update: June 10, 2026
Aylo’s federal lawsuit is now fully briefed in public reporting, and the details sharpen the stakes. As Utah Public Radio reported, Aylo’s complaint focuses on what it calls the “Deemed-Location Provision”: the rule that treats any VPN user who is physically in Utah as a Utah visitor, no matter what their IP address says.
Aylo’s argument is that this puts platforms in an impossible position. Since no website can tell which VPN users are actually in Utah, the only way to comply is to age-verify every visitor worldwide or block VPN traffic entirely. The complaint describes this as a de facto global mandate dressed up as a state regulation, and cites the company’s experience in other states, where up to 80% of users abandoned its platforms rather than complete age verification.
No injunction ruling has been issued yet. The enforcement pause agreed between Aylo and Utah still holds until September 3, 2026. We’ll keep this article updated as the case moves.
What SB 73 actually says
The law’s official name is the Online Age Verification Amendments. Most of its provisions deal with age verification requirements for adult content sites. The VPN section is the part that caught everyone’s attention.
Under SB 73, a person is considered to be accessing a website from Utah if they are physically located in Utah, regardless of whether they’re using a VPN, proxy, or any other location-masking tool. The law then holds website operators liable if a Utah-based user bypasses their age verification using one of these tools.
It also bans covered websites from publishing instructions on how to use a VPN to circumvent age checks.
The enforcement mechanism has teeth. The Utah Division of Consumer Protection can investigate violations and impose fines of up to $2,500 per violation, with additional penalties of up to $5,000 for failing to comply with orders. A separate 2% excise tax on revenue from digital content takes effect October 1, 2026.
Why digital rights groups are furious
The Electronic Frontier Foundation called the law’s VPN provision a threat to digital privacy that goes far beyond its stated purpose. Their position: the collateral damage lands on journalists, abuse survivors, and anyone who uses a commercial VPN to keep their data out of the hands of brokers.
NordVPN described it as an “unresolvable compliance paradox” and a “liability trap.” The logic: websites are being held responsible for identifying users who are specifically using tools designed to be unidentifiable. There is no technical solution to that problem.
The speech restriction component is also notable. Prohibiting websites from giving users factual information about a legal privacy tool raises serious First Amendment questions, something the EFF flagged explicitly in its analysis.
The Aylo lawsuit and the September deadline
On May 13, Aylo, the parent company of Pornhub, sued Utah in federal court. Their argument: the law is impossible to comply with and unconstitutional because it effectively regulates internet users outside Utah’s jurisdiction, violating the US Constitution’s commerce clause.
Utah agreed to pause enforcement of the VPN-related provisions until September 3, 2026 while the case moves through federal court. The core constitutional questions remain unresolved: can a state apply its content regulations to users whose physical location cannot be reliably determined?
The outcome of this case will matter well beyond the adult content industry. If Utah’s approach survives legal challenge, other states will almost certainly adopt similar frameworks.
What this means for VPN users right now
If you’re not in Utah: nothing changes today. The law only applies to users physically located in Utah, and enforcement is on hold anyway.
If you’re in Utah: you may find that some websites start blocking known VPN IP addresses rather than risk liability. This is the most likely short-term outcome: not a government crackdown on VPN use, but a wave of platform-level blocks that affect legitimate privacy users alongside everyone else.
The deeper concern is what happens if the law survives court challenge. States have been watching each other on age verification legislation for several years. A legally validated template for VPN liability would give them a ready-made model to copy.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
The key date is September 3, 2026, when Utah's enforcement pause ends. If the Aylo lawsuit hasn't produced an injunction by then, websites subject to SB 73 will face a real compliance decision. The constitutional questions here are genuinely unsettled. This is worth following closely regardless of where you live.
The bigger picture
This is not the first attempt to target VPN use through legislation. It is the first one to succeed at the state level in the US. The framing, child safety and age verification, is politically difficult to oppose. The mechanism, making websites liable for their users’ tools, is technically unworkable but legally novel.
Whatever happens in federal court, SB 73 has already changed the conversation about what governments can and cannot do to regulate VPN use. That conversation is not going away.
We’ll update this article as the court case develops.
Why this case matters beyond Utah and beyond porn
The framing fight is the real story. SB 73’s mechanism (deeming VPN users to be in-state, then making platforms liable for them) is content-neutral machinery: nothing in the legal architecture confines it to adult sites. The same deemed-location logic could attach to gambling, pharmaceuticals, speech codes or any category a legislature regulates next, which is why digital rights groups treat the case as precedent-setting rather than niche. If platforms can be made responsible for defeating their users’ privacy tools in one category, the template generalizes by find-and-replace.
The federalism question stacks on top: fifty states with fifty deemed-location regimes would make geo-compliance a fiction and VPN-blocking the only rational platform behavior, a de facto national policy enacted by whichever state moves first. That collision (state police powers against the borderless network and the commerce clause) is the constitutional core the Aylo case carries, and it’s why the eventual ruling will be cited far outside this statute.
For VPN users, the watch-item hierarchy: the September 3 enforcement date, any injunction ruling before it, and copycat bills in other legislatures, which several states’ sessions have already hinted at. The article’s update log will track all three.
(Sources for this article’s legal characterizations are linked throughout and at the foot of the page; the statute’s full text remains the primary document, and the EFF’s analysis remains the clearest plain-language walkthrough for non-lawyers.)
Keep reading: Age Verification Laws Are Coming for VPNs Worldwide in 2026 and Chat Control Is Dead. Going Dark Is the EU’s Next Attempt, and This Time VPNs Are on the List..
Sources: EFF analysis of SB 73 | Aylo sues Utah (Deseret News) | Utah Public Radio on the lawsuit | Full text of SB 73