Utah becomes first US state to criminalize VPN use for bypassing age checks

Utah has become the first U.S. state to explicitly criminalize VPN use as a means of circumventing age verification requirements. Senate Bill 73 takes effect on May 6, targeting virtual private networks specifically in the context of age-gated online content restrictions.

The legislation aims to prevent minors from accessing age-restricted material by blocking common technical workarounds. VPNs, which mask a user’s location and IP address, have become standard tools for accessing geographically restricted content and protecting online privacy. The Utah law treats their use to bypass age checks as illegal.

The move reflects a broader national push to restrict minors’ access to adult content and protect children from online predators. Proponents argue that layered enforcement mechanisms, including device restrictions and age verification, are necessary safeguards. Some observers note that online grooming remains a documented problem, pointing to enforcement actions and platform policy changes at companies like Roblox and YouTube as evidence that legislative pressure can drive safety improvements.

However, the law faces significant legal and practical obstacles. Similar age verification measures in other states, including Texas’s attempt to require ID for phone apps, have been struck down in court. Legal experts argue that broad state-level internet regulation violates federal commerce law and communications authority vested in the FCC. Constitutional claims regarding privacy rights and due process are also expected.

Enforceability presents another challenge. Website operators and service providers face conflicting mandates: blocking Utah users entirely, implementing costly age verification systems for all users, or attempting to detect and block VPN traffic. Large technology companies have significant financial incentive to challenge such restrictions in court.

One observer noted that enforcement is nearly impossible without invading user privacy, creating a paradox where the stated protective goal conflicts with the means required to achieve it. Tech industry advocates argue that such laws are too vague, too costly for society, and ultimately unworkable across interstate and international communications networks.

Legal challenges are reportedly already being prepared. Courts have historically sided with defendants in internet regulation cases, particularly when state laws attempt to govern interstate commerce or require companies to violate user privacy expectations.