Age Verification Laws by State: Is a VPN Legal in the US?

Is a VPN legal in the USA?

Yes, under federal law and in every state. No statute in the United States bans VPNs, licenses VPN providers or requires them to verify customers’ ages.

Only one state law mentions VPNs: Utah’s S.B. 73, effective 6 May 2026. It has two VPN provisions, and neither applies to a person using a VPN:

• One deemed a visitor who is actually in Utah to be in Utah “regardless of whether the individual is using a virtual private network, proxy server, or other means” to hide their location. A federal judge preliminarily enjoined this provision on 24 September 2026. That means it is blocked while the case goes on.
• The other bars covered sites from publishing VPN instructions.

The state age-verification laws regulate “commercial entities” that publish or distribute material harmful to minors. Texas HB 1181 covers a site “more than one-third of which is sexual material harmful to minors”. Utah’s S.B. 287 uses the same one-third threshold for a “substantial portion”. Louisiana’s 2022 law, the first of its kind, uses the same test. The duty to check ages, and the penalty for not checking, sit with the site.

The Supreme Court settled the constitutional question on 27 June 2025. The case was Free Speech Coalition v. Paxton, No. 23-1122. Justice Thomas wrote for a six-justice majority that HB 1181 “triggers, and survives, review under intermediate scrutiny because it only incidentally burdens the protected speech of adults”. Intermediate scrutiny is a middle level of court review, easier for a law to pass than strict scrutiny. He also wrote that “adults have no First Amendment right to avoid age verification”. Justice Kagan dissented, joined by Justices Sotomayor and Jackson. The ruling means a state may require the check. It creates no offense for an adult who uses a VPN.

What changed, state by state

Louisiana was first. HB 142 of the 2022 Regular Session became Act 440 and took effect on 1 January 2023. It requires websites with a substantial portion of material harmful to minors to use a commercial age verification system.

The Free Speech Coalition maintains the most complete tracker. It is the adult industry’s trade body, and it was the petitioner in the Supreme Court case. On 31 October 2026 its tracker stated that “Twenty-five states now require age verification for websites that contain ‘material harmful to minors’”. Its map loads its state data dynamically, so we could not extract the list from it. Below we name only the states whose laws we verified on their own legislatures’ sites. The count of 25 is the tracker’s.

• Louisiana: Act 440, effective 1 January 2023.
• Utah: S.B. 287 of 2023, Online Pornography Viewing Age Requirements, sponsored by Senator Todd D. Weiler. It makes a commercial entity liable “if the entity fails to perform reasonable age verification methods”. We did not verify its effective date.
• Virginia: SB 1515, Chapter 811, signed 12 May 2023, effective 1 July 2023.
• Texas: HB 1181, signed 12 June 2023, effective 1 September 2023. Full detail: Texas age verification and VPNs.
• North Carolina: the Pornography Age Verification Enforcement Act in Session Law 2023-132, section 3.20, “effective January 1, 2024”.
• Kansas: SB 394 of 2024 became law without the governor’s signature. It took effect on publication in the statute book. The legislature’s page gives no calendar date.
• Florida: HB 3, Online Protections for Minors, Chapter 2024-42, approved 25 March 2024, effective 1 January 2025.
• Tennessee: the Protect Tennessee Minors Act, Public Chapter 1021, signed 31 May 2024, effective 1 January 2025.
• South Carolina: the Child Online Safety Act, Act 198, signed 21 May 2024. Its age-verification requirement applies “Beginning January 1, 2025”.

The dates follow the pattern of state legislative calendars. Sessions end in spring, and laws take effect on 1 January or 1 July. Texas uses 1 September. Expect the next wave of laws to land on those dates.

The methods the laws accept. Texas HB 1181 requires a site to check ages in one of two ways. It can require a visitor to “provide digital identification”. Or it can require the visitor to “comply with a commercial age verification system that verifies age using: (A) government-issued identification; or (B) a commercially reasonable method that relies on public or private transactional data”.

Utah’s 2023 law lists these methods:

• a digitized identification card
• an independent third-party verification service that checks against “a commercially available database”
• transactional data

Both laws forbid retaining identifying information. The Supreme Court called government ID and transactional data “plainly legitimate” methods.

App store age laws. Two states moved the check from the website to the phone.

Utah’s S.B. 142 of 2025, the App Store Accountability Act, took effect on 7 May 2025. Its duties on app store providers and developers took effect on 6 May 2026. Its enforcement section takes effect on 31 December 2026. It requires an app store provider, “at the time an individual who is located in the state creates an account”, to “verify the individual’s age category”. The categories are:

• child, under 13
• younger teenager, 13 to 15
• older teenager, 16 to 17
• adult, 18 and over

The store must also link a minor’s account to a parent account. It must “obtain verifiable parental consent” before a minor downloads an app, purchases one or makes an in-app purchase. Parents get a private right of action, which means they can sue. They can recover the greater of actual damages or $1,000 per violation.

Texas’s SB 2420 was signed on 27 May 2025, with an effective date of 1 January 2026. It uses the same four age categories and requires consent for each download or purchase. It makes a violation a deceptive trade practice. Its court history so far:

• Judge Robert Pitman preliminarily enjoined it on 23 December 2025.
• The Fifth Circuit granted Texas a stay pending appeal on 4 June 2026, which paused that injunction. It held that app listings “propose a commercial transaction” and are subject at most to intermediate scrutiny.
• The Supreme Court denied an application to vacate that stay on 6 July 2026.

The law is enforceable while the appeal continues. The Texas Tribune reported that the trade group CCIA expected an expedited Fifth Circuit hearing in early August 2026. We found no merits decision as of 31 October 2026.

Utah’s VPN provisions. S.B. 73 of 2026 is the Online Age Verification Amendments. Its chief sponsor was Senator Calvin R. Musselman, and its House sponsor was Representative Steve Eliason. It took effect on 6 May 2026 and added two subsections to Utah Code 78B-3-1002.

• Subsection (3) applies when an individual is “actually located in the state”. It deems that individual to be accessing a site from Utah “regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location”.
• Subsection (4) says a covered site “may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements”. That includes providing “instructions on how to use a virtual private network or proxy server to access the website”.

Aylo Freesites challenged subsection (3). On 24 September 2026 Judge David Barlow of the District of Utah preliminarily enjoined it, in case No. 2:26-cv-00340. He found that it likely violates the dormant Commerce Clause. That is the constitutional rule that limits how far a state law can burden trade with other states. In his view, the provision, read with the rest of the statute, “requires entities like Aylo to geolocate its website users with perfection to avoid liability”. To geolocate means to work out where a user is. He also found that “geolocation perfection is not presently possible”.

Fox 13 reported on 12 October 2026 that the court had stayed, or paused, the case at both parties’ request until after the 2027 legislative session. The injunction remains in force, and subsection (4) was not challenged. Details: Utah’s VPN age-check provision blocked.

What a VPN changes, and what it does not

A VPN swaps your IP address for the server’s. Your IP address is the number websites see for your connection. A site may show its age check only to visitors from Texas or Florida, for example. It will not show the check to a connection that appears to come from another state or country. And a site that has blocked a state’s visitors rather than comply will treat the connection as out of state.

That is why demand jumps whenever a block begins. Newsweek reported a 234.8 percent increase in VPN demand from Texas on 15 March 2024, the day after Aylo’s sites went dark in the state. It also reported that ExpressVPN saw a 35 percent rise in Texas use.

A VPN does not change which state’s law applies to a website. It does not touch a check that a site applies to every visitor. It does nothing at all against the app store laws, because those checks are tied to the account on the device, not to where the device appears to be. A VPN also does not alter a payment card’s billing state.

For an adult, the legal position is unchanged either way. No state law penalizes avoiding a check, and the only practical exposure is a site’s terms of service. Our is my VPN working? tool shows what a site can see.

Enforcement so far

Enforcement runs through state attorneys general, and Texas has been the most active. Its Attorney General sued Aylo Global Entertainment on 26 February 2024. On 21 March 2024 the office sued Multi Media LLC and Hammy Media. It sought injunctions and civil penalties:

• up to $10,000 a day
• a further $10,000 a day for retaining identifying information
• $250,000 “if a child is exposed to pornographic content due to not properly verifying a user’s age”

On 1 July 2026 the office announced a court order, called a writ, directing the .com registry to lock the domain of a site operated by Kick Online Entertainment. The company had ignored a default judgment, which is a ruling against a party that does not respond to a lawsuit. It can recover the domain only by posting a $9.14 million bond conditioned on compliant age verification.

Utah’s law is enforced by its Division of Consumer Protection. Commerce Commissioner Margaret Woolley Busse told Fox 13 on 30 October 2026 that enforcement starts on 2 November. The division can fine a site up to $2,500 for each violation. Details: Utah age verification enforcement.

We did not verify enforcement actions by other states’ attorneys general for this page. The app store laws have produced litigation rather than penalties so far. We found no enforcement action anywhere in the United States against a VPN provider or a VPN user for using a VPN.

What could change next

Watch four things.

• The Fifth Circuit’s merits ruling on Texas SB 2420. This is its decision on the appeal itself, after the stay. It will decide whether app-store age verification spreads beyond Utah and Texas. A VPN cannot affect that kind of check.
• New state laws. They will arrive on 1 January and 1 July. The Free Speech Coalition tracker lists pending bills by state.
• Federal law. We found no federal age-verification statute in force on 31 October 2026. The Free Speech Coalition tracker lists congressional bills alongside the states.
• Rules aimed at VPN use. The UK’s July 2026 decision to make social media companies detect VPN use by under-16s shows the direction platform-level rules could take. Utah’s attempt to deem VPN users who are physically in Utah to be in-state is the only state provision aimed at VPN use. It is enjoined while the Legislature decides whether to rewrite it in 2027. Its sponsor, Senator Calvin Musselman, told Fox 13 on 30 October that he is working on a revision.

We re-check this page at least every 30 days and record each development in the timeline above.

Related

• VPN laws and age-verification tracker
• Age verification and VPNs: the global picture
• Texas age verification and VPNs
• Is a VPN legal in the UK?
• Australia age verification and VPNs
• Best VPNs for privacy