Is a VPN Illegal in Utah? SB 73 Explained (2026)

No, using a VPN in Utah is not illegal. Utah's SB 73 is the first US state law that mentions VPNs in the context of age verification, but it puts the duties on websites, not on you. And the part about VPNs is on hold: a federal judge blocked it on 24 September 2026, and on 13 October the lawsuit was paused until lawmakers revisit the law in 2027. Here is what the law says, what the court did, and what it means if you live in Utah or travel there.

Short answer: what SB 73 means for VPN users

SB 73 sets no fine or penalty for people who use a VPN. It tells commercial sites with a large share of adult content to verify the age of anyone physically in Utah, even when that person connects through a VPN. The court has blocked that VPN provision for now. VPNs remain legal in Utah for work, travel and privacy.

Timeline: from bill to court pause

Dates are from court coverage by KPCW, Fox 13 and the Deseret News, and from the EFF. We checked them on 14 October 2026.

What the law actually says

SB 73 builds on Utah's 2023 rules for adult websites. For VPN users, the parts that matter are these.

Who has to verify ages

Commercial websites that publish material harmful to minors, when that material is more than one third of the site. Social networks, news sites, streaming services and app stores are outside it unless they cross that threshold.

Where the law says you are

The law counts you as a Utah user if you are physically in Utah, "regardless of whether" you use a VPN, a proxy server or another tool to hide your location. A person in Salt Lake City on a server in Germany is still a Utah user in the eyes of the law. This is the provision the court blocked.

What sites must not say

Covered sites may not encourage VPN use to get around the age check or publish instructions for doing so. The court's September order did not touch this rule: it blocked only the location provision described above, so the ban on VPN instructions still applies to covered sites.

Enforcement belongs to Utah's Division of Consumer Protection. Reports put administrative fines at up to $2,500 per violation, with civil penalties on top. Every one of those penalties targets the website.

What the court blocked, and why

Aylo argued that it has no way to know whether a visitor hiding behind a VPN is actually in Utah. The judge agreed that this was likely to succeed. Under the amended statute, he wrote, a site would have to "geolocate its website users with perfection" to avoid liability, and it is undisputed that such technology does not exist. In legal terms, the provision likely puts an excessive burden on interstate commerce, which the Constitution's dormant Commerce Clause forbids.

Utah argued that the law only asks for "reasonable efforts" to locate users, not perfection. The court read the text as written and found something close to strict liability.

Two limits on the ruling:

• It is a preliminary injunction. The case hasn't been decided on the merits.
• It covers the location provision, not the whole framework. Adult sites still have to verify Utah visitors. Under the September agreement with the state, Aylo kept its sites blocked in Utah, as it has since 2023.

What it means if you live in Utah

Nothing you do with a VPN became illegal, and nothing did in May either. Using a VPN for remote work, for banking while traveling or to keep your browsing away from your internet provider is the same as before.

What may change is how websites treat VPN traffic. The EFF warned that a law making sites liable for VPN users pushes them toward one of two cheap answers: block known VPN addresses for everyone, or ask every visitor for ID. Neither has happened at scale on mainstream sites so far, and the injunction removes the pressure for now. If the legislature rewrites the provision in 2027, watch for this again.

The bigger privacy question is the age check itself. Verification usually means a face scan or an ID photo handled by a third-party company. We covered the same debate in the UK and EU in our guide to age verification and privacy. The advice carries over: don't upload documents to a verifier you haven't checked, and prefer methods that prove your age without sending your identity.

This article explains the law. It isn't a guide to getting around age checks, and VPNs are no substitute for parental controls on a child's device.

Are other states doing the same?

Utah is alone with a law on the books, but the idea keeps coming back.

In Wisconsin, the age-verification bill AB 105 at first would have required adult sites to block all VPN users. After pushback, that clause was removed in February 2026. Governor Tony Evers then vetoed the whole bill on 3 April 2026, calling it "an intrusion into the privacy of Wisconsin residents", and the override vote failed on 13 May.

Indiana went to court instead. The state attorney general sued Aylo in December 2025 under Indiana's 2024 age-verification law, arguing that the company knew people still reached its sites through VPNs. In October 2026 Aylo cited the Utah injunction in asking the Indiana court to dismiss the case.

Michigan saw the bluntest version. House Bill 4938, the "Anticorruption of Public Morals Act" introduced in September 2025, would make internet providers detect and block VPNs and proxies. It has not passed: as of 2026 it sits in the House Judiciary Committee without a hearing.

Abroad, the UK's Online Safety Act triggered the same arguments in 2025. Several countries ban or restrict VPNs outright, but no US state does.

What comes next

The case is frozen until the 2027 session ends on 5 March 2027, with a joint status report due on 19 March. Expect one of three outcomes: lawmakers rewrite the provision around "reasonable efforts", drop it, or keep it and the lawsuit resumes. We'll update this page when that happens.

Using a VPN for privacy in Utah

A VPN hides your IP address from the sites you visit and keeps your browsing out of your provider's logs, which is why it's routine on hotel and airport Wi-Fi. If you pick one, look at what the VPN itself knows about you. With MeerGuard you sign up through a Telegram bot without an email, can pay with an international card, crypto or Telegram Stars, and we keep no activity logs. Plans and servers are on the pricing page. Whatever you use, run a leak test once to confirm that your real address doesn't slip out through the browser.

Sources

• Utah Legislature, SB 73 "Online Age Verification Amendments", 2026 General Session, le.utah.gov
• EFF, "Utah's New Law Targeting VPNs Goes Into Effect Next Week", April 2026, with later updates
• Deseret News, "Utah pauses age verification rule enforcement with Pornhub owner pending court ruling", 4 September 2026
• KPCW, "Federal judge blocks Utah's VPN update to its online porn age verification law", 25 September 2026
• Fox 13 Salt Lake City, coverage of the injunction and of the 13 October 2026 stay
• CyberInsider, "Court blocks Utah VPN rule over impossible location checks", 6 October 2026
• Free Speech Coalition and LegiScan, Wisconsin AB 105 history: veto 3 April 2026, failed override 13 May 2026
• Indiana Capital Chronicle, "Attorney general sues pornographic websites", 15 December 2025