TL;DR
Utah's SB 73 takes effect May 6, 2026, and it's the first US state law that explicitly holds websites liable when users bypass age verification with VPNs. If you run a site with adult content, operate a VPN service, or simply want to understand your exposure: the law treats VPN users as physically present in Utah regardless of their spoofed location, and it also prohibits sites from explaining how VPNs work. The immediate decision is whether your current compliance stack can detect VPN traffic at all—most can't.
The Hidden Mechanic: "Regardless of VPN" Changes Everything
Most age verification laws treat the technical layer as someone else's problem. California's upcoming law pushes age checks to the OS level. The federal "Parents Decide Act" proposal (still pending) would nationalize some form of this. Utah went sideways. SB 73's critical clause—"regardless of whether the individual is using a virtual private network"—shifts liability to the website operator for circumvention they have limited power to stop.
Here's what the tutorial under-explains. VPN detection is probabilistic, not binary. IP reputation databases flag known VPN exit nodes, but residential proxy services and newer VPN infrastructure rotate faster than most commercial feeds update. A site complying in good faith can still miss sophisticated bypass. The law doesn't specify what "reasonable" detection looks like. That ambiguity is the trap.
The trade-off matrix looks like this:
| Approach | Blocks casual VPN use | Blocks determined bypass | Cost/complexity | Legal exposure if bypass succeeds |
|---|---|---|---|---|
| Basic IP blocklist | Yes | No | Low | High—you knew VPNs existed, did minimum |
| Commercial VPN detection API | Mostly | Partial | Medium | Medium—demonstrated effort |
| Device fingerprinting + behavioral | Better | Better | High | Lower—multiple signals, harder to fake |
| Full KYC (government ID upload) | Yes | Yes | Very high | Lowest—but creates new privacy liability |
The asymmetry: stricter verification reduces SB 73 exposure but increases GDPR/CCPA/privacy breach risk. Every uploaded ID is a target. Most operators optimize for one threat model and get blindsided by the other.
First-hour priority if you operate affected content: audit your current VPN detection false negative rate against a fresh residential proxy feed, not last year's blocklist. The delta between "we check" and "we catch" is where Utah's liability lives.
What the Law Actually Prohibits (Beyond the Obvious)
The under-explored mechanic: SB 73 bans affected sites from providing "instructions on how to use a virtual private network." This is broader than a "how to bypass our filter" page. Interpreted broadly, it could cover:
- General privacy guides that mention VPNs
- Troubleshooting docs for connectivity issues
- Even linking to EFF or consumer advocacy resources
The edge case no one discusses: what if your site has a help center article explaining why a user sees an age gate, and that article mentions VPN detection as the reason? You're now explaining VPNs in the context of circumvention. The line between transparency and prohibited instruction hasn't been tested in court.
For VPN services themselves, the positioning problem is acute. You can't market to Utah users as "access blocked content" without potential aiding-and-abetting exposure. But "privacy protection" remains a legitimate use case. The marketing language gap is narrow and getting narrower.
Decision shortcut: if you're a VPN provider, segment your Utah-facing messaging immediately. Remove any copy that references content unblocking, streaming region bypass, or age gate circumvention—even obliquely. The compliance cost of overcorrection is lower than one Utah AG inquiry.
For individual users: the law doesn't criminalize VPN possession or personal use. The liability sits with websites and (potentially) services that facilitate circumvention. Your risk profile hasn't shifted directly. What has shifted is the reliability of VPNs for accessing Utah-restricted content, as sites deploy heavier detection to protect themselves.
The Next 2-3 Decisions That Shape Your Run
Decision 1: Detection depth vs. user friction
If you operate a covered site, you face a classic optimization problem. Aggressive VPN detection adds checkout friction, increases abandonment, and flags legitimate travelers (business VPNs, corporate remote access). Passive detection misses more bypass. There's no dominant strategy—only a choice about which failure mode you can afford.
The non-obvious variable: your user's alternative options. If competitors have lighter gates, aggressive detection pushes traffic to them without reducing total minor exposure across the ecosystem. If you're the only provider (niche content, captive audience), you can afford more friction. Most operators guess wrong here, over-investing in detection for low-leakage scenarios or under-investing where users actually pivot.
Decision 2: Geofence granularity
Utah-only compliance is technically possible but commercially painful. Most age verification vendors sell national or regional packages. Building Utah-specific logic means custom integration or accepting broader scope. The hidden cost: maintaining separate verification flows by state scales poorly as more states pass similar laws. California's 2027 OS-level requirement may obsolete site-level investment entirely.
Short-term shortcut: use a vendor that offers state-level rule sets with migration paths to federal compliance if the Parents Decide Act passes. Avoid locked-in Utah-specific builds.
Decision 3: Documentation audit
The "no VPN instructions" clause is a sleeper. Review every help article, FAQ, error message, and support script that mentions connectivity, region, or access issues. The safest path: remove VPN references entirely from customer-facing docs, route technical questions to human support with scripted responses reviewed by counsel. Automated chatbots are high-risk here—they generate unreviewed explanatory content at scale.
What to Do Differently
Stop treating VPN detection as a checkbox. SB 73's innovation isn't requiring age verification—it's making the verification resilient to a specific bypass method, with liability for failure. Most compliance guides will tell you to "implement age verification" as if the vendor selection is the hard part. The hard part is proving your implementation was sufficient when a determined minor gets through, and Utah's law doesn't give you safe harbor for trying. Audit your detection's actual catch rate against current bypass methods, not your vendor's marketing claims. Then audit your own documentation for accidental instruction. The gap between compliance theater and real exposure is where this law will be tested first.
Disclaimer
This article is for informational purposes only and does not constitute legal advice. SB 73's interpretation and enforcement may evolve through regulatory guidance or court decisions. Consult qualified legal counsel for compliance decisions specific to your situation.
