SALT LAKE CITY, Utah – Earlier this week, provisions of Utah’s SB 73, which updates the state’s existing age-verification mandate, went into effect. Under the newly enforceable provisions, the Utah Division of Consumer Protection is enabled to enforce the age-verification mandate, platforms are banned from encouraging the use of a virtual private network (VPN) or other technical means of circumventing the mandate and covered platforms are required to verify the age of any user physically located in Utah, regardless of that user’s IP address.
In a statement published to the organization’s blog Tuesday, the Free Speech Coalition (FSC) noted that “in practical terms, this means that compliance strategies that depend on IP addresses, such as geoblocking may not be effective at mitigating liability.”
“Even platforms that do currently age-verify visitors from the state could run afoul of the law if a Utahn uses a VPN to disguise their location, or if their IP address belongs to a range associated with a neighboring state like Arizona or Nevada,” FSC added.
FSC Executive Director Alison Boden said the updated law “makes compliance extremely difficult, if not impossible.”
“Determining geolocation based on IP address is imperfect,” Boden added. “With SB 73, Utah is effectively overriding the laws of every other jurisdiction and requiring platforms to age-verify every single visitor to their sites. Platforms should discuss how to approach this situation with their attorneys.”
FSC also noted that a separate provision of SB 73 establishing a 2% excise tax on sales of adult content in Utah, goes into effect October 1, 2026.
Other critics of SB 73 have noted the law’s VPN provisions are both constitutionally questionable and have the potential to seriously undermine the privacy of the internet’s users – and not just those who reside in the state.
In a post analyzing SB 73, Rindala Alajaji, the Associate Director of State Affairs for the Electronic Frontier Foundation, observed the law’s new provisions “won’t stop a tech-savvy teenager, but they certainly will impact the privacy of every regular Utah resident who just wants to keep their data out of the hands of brokers or malicious actors.”
“Attacks on VPNs are, at their core, attacks on the tools that enable digital privacy,” Alajaji added. “Utah is setting a precedent that prioritizes government control over the fundamental architecture of a private and secure internet, and it won’t stop at the state’s borders.”
FSC members can read more about SB 73 in April’s FSC Policy Update. Non-members can find more information on SB 73 from FSC, including a link to the text of the legislation, through the FSC Action Center.
