Utah's VPN Law Is Now in Force, and 100+ Groups Answered With a 'Defend VPNs' Day of Action

Three weeks ago, Utah became the first US state to enforce a law that explicitly accounts for VPN use. On September 25, digital rights groups answered with the second annual “Defend VPNs” Day of Action, coordinated by Fight for the Future and backed by more than 100 organisations. Neither event bans VPNs. Both show where the fight over them is heading.

Utah’s SB 73: what took effect on September 3

Utah’s SB 73 is an age-verification law. It requires websites where more than one-third of the content is “harmful to minors” to verify the age of Utah users. What makes it different from the dozens of similar state laws is how it defines a Utah user.

As Gizmodo explained, the law treats anyone physically located in Utah as a Utah user, regardless of VPN use. A Salt Lake City resident connecting through a server in Germany is still, legally, in Utah. Sites that fail to comply face $2,500 per violation, plus civil liability.

The law was originally due in May 2026. Aylo, Pornhub’s parent company, challenged it in court, and Utah agreed to pause enforcement until September 3, a story we covered in June when the enforcement pause was announced. That pause has now run out, and the law is enforceable.

What SB 73 means for VPN users

Let’s be precise, because headlines haven’t always been.

It isn’t a VPN ban. Using a VPN in Utah remains legal for privacy, work, travel or streaming. Gizmodo’s piece stresses the same point.

The burden is on websites, not VPN users. A covered site has to work out whether a visitor is physically in Utah, even when their IP address says Frankfurt or Toronto. There’s no reliable way to do that from an IP address alone, which is the problem. In practice, sites either verify everyone, use more invasive location signals (GPS, device data), or block Utah and VPN traffic broadly.

VPN providers are nervous anyway. NordVPN called the approach a “liability trap”, according to Gizmodo. If a site can be fined because a user hid behind a VPN, pressure shifts toward detecting and blocking VPN traffic across the board. That affects everyone who uses a VPN, not just people trying to skip an age check.

Our original breakdown of the bill, Utah’s SB 73 explained, goes through the legal text in more detail.

Why “physically located in Utah” is so hard to check

The whole law rests on one idea: a website should know where a visitor physically is. Technically, that’s much harder than it sounds.

IP geolocation is the standard tool, and it’s the one a VPN defeats by design. A VPN user in Provo shows up with the IP address of a server in Denver, Paris or Tokyo.

VPN IP lists are the next step. Commercial databases flag IP ranges belonging to VPN providers and data centres. They’re decent at catching popular VPN servers and bad at catching residential proxies, mobile networks and new IPs. They also can’t say where the person behind the VPN is, only that they’re using one.

Device location (GPS, Wi-Fi positioning) is precise, but browsers only share it with explicit permission, and nobody grants that to read a news site.

So a site that wants to be safe under SB 73 has three options: verify everyone’s age regardless of location, block all VPN traffic, or accept legal risk. Each of those spills over onto people who have nothing to do with Utah. That spillover is exactly what the Defend VPNs coalition is warning about.

The Defend VPNs Day of Action on September 25

Fight for the Future organised the first Defend VPNs day last year, with about 20,000 participants according to the group. The second edition was set for September 25, 2026, with a coalition of over 100 human rights, reproductive justice, LGBTQ and digital rights organisations.

The day targeted a list of laws and proposals that restrict VPN access or push ID-based age verification:

• Utah’s SB 73, the first US state law to account for VPN use
• Wisconsin’s age-verification bill, which narrowly avoided including a VPN ban (we covered why these clauses keep failing)
• Michigan’s proposed outright VPN ban, HB 4938
• Australia’s age-verification rules and the UK’s approach to VPNs
• youth social media bans in Indonesia, Malaysia and the UAE, and proposals in France and Massachusetts

The core demand is simple: VPN access should be protected as a right, not treated as a loophole. Campaign director Sarah Phillips put it bluntly: “Using VPNs is not criminal.”

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

Why this is happening now

Age verification laws have spread fast. Proton’s age verification map shows they’ve already spread to dozens of countries, and we track the global picture in our age verification and VPN crackdown overview. Every time a country or state adds an age check, VPN downloads spike, lawmakers notice, and the next draft tries to deal with VPNs.

There are only a few ways a law can “deal with” VPNs, and none of them is clean:

1. Ban VPNs outright (Michigan’s proposal). Hard to enforce, likely unconstitutional in the US, and damaging to businesses and security.
2. Make websites responsible for VPN users (Utah). Pushes sites to block VPN traffic or collect more location data.
3. Make VPN providers enforce blocks or checks. That’s the direction of the new federal American Copyright Protection Act, which would make large VPNs block piracy sites, and of some European proposals.

Advocacy groups see a pattern: laws sold as protecting children or copyright gradually normalise VPN detection and blocking, which then gets used for other purposes. Lawmakers see VPNs as a hole in every rule they pass. That tension isn’t going away.

What you should actually do

If you’re in Utah, nothing changes about using a VPN legally. You may notice more sites asking for age verification, and more sites refusing VPN connections. If you’re outside Utah, the direct effect is zero, but the indirect effect is real: VPN-blocking tools built for one law are deployed for everyone. A news site, a forum or a shop that decides blocking VPNs is cheaper than checking IDs will block you in Zurich or London just as readily as in Salt Lake City.

Two practical points:

• Keep choosing audited, reputable VPNs. Pressure on the industry tends to push people toward free apps that nobody regulates and nobody audits. That’s the wrong direction for your privacy. Our list of the best audited no-logs VPNs is the safer starting point, led by NordVPN and ProtonVPN.
• Don’t expect a VPN to solve ID checks. Age verification relies on documents or facial scans, not location. A VPN can’t change what you are asked to prove once a site decides to ask.

If you run a website yourself, this is worth a conversation with a lawyer rather than a blanket VPN block. Blocking all VPN traffic also blocks journalists, remote workers and people on corporate networks, which is a high price for compliance with a single state’s rule.

We’ll keep tracking Utah’s enforcement, the court challenges and the next wave of state bills.