SALT LAKE CITY — Utah’s latest update to its age-verification law took effect this week, but critics say the changes could create major compliance headaches for online platforms while raising broader concerns about privacy and internet access.
The newly enforceable provisions under SB 73 expand the state’s existing age-verification requirements in several ways. The law now gives the Utah Division of Consumer Protection authority to enforce the mandate directly, prohibits platforms from encouraging users to bypass restrictions through virtual private networks (VPNs) or similar tools, and requires covered websites to verify the age of users physically located in Utah regardless of the IP address attached to the connection.
That last part is what’s getting the most attention.
In a statement posted Tuesday, the Free Speech Coalition warned that the law could complicate compliance strategies many platforms currently rely on.
“In practical terms, this means that compliance strategies that depend on IP addresses, such as geoblocking may not be effective at mitigating liability,” the organization said.
The group noted that even platforms already conducting age verification for Utah visitors could still face legal exposure if a resident uses a VPN to mask their location or if an IP address is incorrectly associated with another nearby state such as Arizona or Nevada. And honestly, that’s where the situation starts to feel messy fast. Internet geography has never exactly been precise.
FSC Executive Director Alison Boden said the updated law creates a difficult environment for websites attempting to comply.
“Determining geolocation based on IP address is imperfect,” Boden said. “With SB 73, Utah is effectively overriding the laws of every other jurisdiction and requiring platforms to age-verify every single visitor to their sites. Platforms should discuss how to approach this situation with their attorneys.”
The organization also pointed out that another section of SB 73 — a new 2% excise tax on adult content sales within Utah — is scheduled to take effect Oct. 1, 2026.
Privacy advocates and digital rights groups have also raised concerns about the law’s provisions surrounding VPNs.
Critics argue the restrictions could create constitutional issues while weakening online privacy protections not only for Utah residents, but potentially for internet users more broadly. VPNs are commonly used for far more than bypassing geographic restrictions. Many people rely on them for security, encrypted browsing, or simply keeping personal data away from advertisers and data brokers.
In an analysis of SB 73, Rindala Alajaji, associate director of state affairs for the Electronic Frontier Foundation, argued the law’s new provisions are unlikely to stop determined minors from accessing restricted content.
“Won’t stop a tech-savvy teenager, but they certainly will impact the privacy of every regular Utah resident who just wants to keep their data out of the hands of brokers or malicious actors,” Alajaji wrote.
She added that the broader implications extend beyond Utah itself.
“Attacks on VPNs are, at their core, attacks on the tools that enable digital privacy,” Alajaji said. “Utah is setting a precedent that prioritizes government control over the fundamental architecture of a private and secure internet, and it won’t stop at the state’s borders.”
Additional guidance and policy analysis surrounding SB 73 has been made available through the Free Speech Coalition’s policy resources and action center for members and non-members seeking more information about the law and its implementation.
The War on Porn Regular Updates about the Assault on The Adult Industry