Utah is about to become the first state in the country to explicitly target VPN use in its age verification legislation. Senate Bill 73, known as the Online Age Verification Amendments, takes effect May 6 and places the legal burden squarely on websites - not users - when minors access age-restricted content through a virtual private network. The law arrives as a patchwork of federal and state-level age verification measures is spreading rapidly across the US, each with its own assumptions about how online identity should be confirmed and who bears responsibility when those systems fail.
What the Law Actually Requires
Under Senate Bill 73, any website hosting "a substantial portion of material harmful to minors" must implement age verification before granting access. That much is consistent with similar laws passed in other states. The departure comes with the VPN clause: if a user circumvents the site's verification system through a VPN - masking their location, IP address, or other identifying signals - the site remains legally liable. In other words, the technology defense does not hold.
This is a significant shift in how liability is assigned. Most existing frameworks treat circumvention as the user's problem. Utah's approach treats it as an unresolved verification gap that the platform is still responsible for closing. The practical implication is that websites cannot simply install a checkbox or a location-based filter and consider the obligation fulfilled. They must either build systems robust enough to function even when location data is spoofed, or risk being found in violation of state law.
The Wider Landscape This Fits Into
Utah's bill does not emerge in isolation. California has passed legislation requiring operating systems - including Linux-based systems - to verify user age at the point of account setup, with that law set to take effect next year. At the federal level, the proposed Parents Decide Act could extend similar requirements nationwide, which would make state-by-state variation less of a patchwork and more of a floor with an uncertain ceiling above it.
The political momentum behind age verification is real and bipartisan. Concerns about minors accessing adult content, social media platforms, and algorithmically driven material have found traction across the political spectrum in a way few technology policy issues do. That consensus, however, has not produced consensus on method. What counts as adequate verification - and who gets to decide - remains deeply contested.
Why Experts Are Skeptical of Current Approaches
Researchers and civil liberties advocates have raised consistent alarms about the form age verification is currently taking. The core tension is this: any system capable of reliably confirming a user's age requires collecting sensitive personal data. That data - government IDs, facial scans, credit card information, biometric markers - creates new privacy risks even as it attempts to solve an existing safety problem. A breach or misuse of such a database could expose intimate details about what adults and minors alike were accessing and when.
There is also the question of effectiveness. VPNs are widely available, often free, and simple enough to use that a determined minor faces little practical barrier. Holding platforms liable for circumvention they cannot technically prevent puts companies in an impossible position: comply with the letter of the law by implementing verification, and still face penalties when users route around it. Critics argue this dynamic will push smaller platforms out of certain markets entirely, concentrating access to content - including legal adult content - among a handful of large operators who can absorb legal risk.
What Comes Next
Utah's law is likely to face legal challenges. Previous age verification laws in other states - including earlier Utah legislation targeting social media - have been challenged on First Amendment grounds, with courts scrutinizing whether such measures restrict constitutionally protected speech in the process of protecting minors. The VPN liability provision adds a new dimension to that argument, since it potentially holds platforms responsible for user behavior that the platforms themselves cannot monitor or intercept without undertaking their own invasive surveillance.
What is clear is that the age verification debate in the US has moved well past the question of whether such systems should exist. It is now a debate about architecture - about which technical methods are acceptable, which data collection practices are proportionate, and how liability should be distributed between platforms, users, and the state. Utah has placed a firm answer to that last question on the table. Whether courts, other legislatures, or federal regulators agree with it will shape the broader direction of online safety policy for years to come.