Utah has taken an unprecedented step in its quest to restrict access to online pornography. It appears to be a first-in-the-nation attempt to regulate the use of VPNs, or virtual private networks.
The new law went into effect May 6, and critics charge that it is unworkable and poorly written.
“Even if you're well-intentioned and want to comply with this law, it's nearly impossible to do so,” said Rindala Alajaji, associate director of state affairs for the Electronic Frontier Foundation, a digital rights nonprofit.
It builds off of the state’s 2023 law that required adult content websites to verify the ages of Utah users. Some sites, including PornHub, blocked access for the entire state rather than comply. Shortly after, there was a spike in Utahns Googling how to get a VPN, which disguises a user’s location, effectively skirting restrictions by changing the user’s IP address.
Fast forward to today, and the new law says adult content websites must verify the ages of any users physically located in Utah, regardless of whether they’re using a VPN to digitally say they’re somewhere else.
The main purpose of a VPN is to secure and encrypt a user’s traffic as well as change a user’s location. While technology exists to detect and block virtual private networks, Alajaji said there’s no way to block every VPN.
The law puts the liability on the adult content websites to age-check Utah users. To fully comply, Alajaji said, a website may have to verify the ages of every visitor, regardless of where their IP address says they’re located. If someone lives in California, for example, Alajaji said their access shouldn’t be restricted because of a Utah law.
“That obviously is beyond the bounds of what Utah legislators should be legislating,” she said.
Additionally, she said this law is uncharted territory. To her organization’s knowledge, Utah is the first state to try to regulate VPNs in this way. While the Utah Legislature may view them as a “loophole” to violate the law, Alajaji said VPNs are a widely used privacy tool and should be protected. She emphasized that VPNs as a whole are still legal in Utah. People use them to access internal systems at their job while working remotely or to protect their online privacy.
Alajaji is concerned about others following in Utah’s footsteps.
“Our worry here is that this opens the door to other states and other countries to start creating these unworkable mandates,” Alajaji said. “And making legitimate security tools something that is deemed not safe or not legal.”
The 2026 law also bans adult content websites from sharing instructions on how to use a VPN, which Alajaji said raises First Amendment concerns. And it created a 2% tax for transactions on online pornography websites.
The Republican sponsor of the law, Sen. Calvin Musselman, didn’t respond to KUER’s request for an interview but provided a statement.
“Protecting kids while preserving freedom is not a new concept,” Musselman wrote. “S.B. 73 is about accountability, requiring companies that profit from material harmful to minors to take reasonable steps to help prevent access by children.”
Musselman said websites could have a process for users to verify their age or confirm which state they’re in, “while still preserving the encryption options for users.”
The group Fight for the Future, which says it works to ensure technology is a force for free expression, said it pre-emptively endorses any lawsuit challenging the law, though none have been announced yet.
Campaigns and Communications Director Lia Holland said the state was embarrassing itself with its first-in-the-nation law and that the legislation sounded like “AI slop.” She questioned whether Utah lawmakers understand VPNs.
“Because you cannot require a website doing age verification to determine where someone using a reputable VPN is browsing from — this feat is literally impossible by design for even the best hacker,” Holland said.
The state Division of Consumer Protection is responsible for enforcing the law. During the legislative session, Consumer Protection Director Katie Hass testified that the VPN provisions were technologically feasible.
In a statement, the division kept the onus on online platforms to police and verify their users.
“This year, the Utah legislature added state enforcement of the law,” the statement said. “These distributors continue to have a responsibility to prevent Utah children from accessing this harmful content, including safeguarding against known workarounds.”
