Texas Age Verification and VPNs: HB 1181 and SB 2420

Is a VPN legal in Texas?

Yes. Texas has no law against buying, installing or using a VPN. Two age-verification laws put the state at the center of this debate, and neither touches VPN users.

HB 1181 has been in force since 1 September 2023. It applies to a “commercial entity that knowingly and intentionally publishes or distributes material on an Internet website, including a social media platform, more than one-third of which is sexual material harmful to minors”. SB 2420, the App Store Accountability Act, applies to app store owners and software developers. Every duty and every penalty in both laws attaches to those businesses.

An adult in Texas who connects through a server in another state or country breaks no Texas law by doing so. The only risk is a website’s or platform’s terms of service.

The constitutional fight over HB 1181 is also over. On 27 June 2025 the Supreme Court held that the law “triggers, and survives, review under intermediate scrutiny because it only incidentally burdens the protected speech of adults”. Intermediate scrutiny is a middle level of court review. A law passes it more easily than strict scrutiny, the toughest test. The Court also held that “adults have no First Amendment right to avoid age verification”. That decides what a state may require of websites. It says nothing about how an adult reaches those websites.

What changed

HB 1181 (2023). The law was signed on 12 June 2023 and took effect on 1 September 2023. It sits in Chapter 129B of the Civil Practice and Remedies Code. A covered site must check ages in one of two ways. It can require each visitor to “provide digital identification”. Or it can require the visitor to “comply with a commercial age verification system that verifies age using: (A) government-issued identification; or (B) a commercially reasonable method that relies on public or private transactional data”.

The site “may not retain any identifying information of the individual”. The Attorney General enforces the law. Civil penalties can total:

• “$10,000 per day that the entity operates an Internet website in violation”
• a further $10,000 per instance of retaining identifying information
• “an additional amount of not more than $250,000” if minors access the material because of a violation

The litigation. The Free Speech Coalition and adult-industry plaintiffs sued to block the law. They argued that it was a facial violation of the First Amendment. A facial challenge attacks a law as written, not just the way it is applied in one case. The Fifth Circuit held that an injunction was not warranted. It treated HB 1181 as a regulation of the distribution to minors of material obscene for minors. That decision is reported at 95 F.4th 263. The Attorney General describes a November 2023 ruling “allowing Texas to enforce the law”.

The Supreme Court granted certiorari, which means it agreed to hear the case. It heard argument on 15 January 2025 and decided the case on 27 June 2025. Justice Thomas wrote for the Court, joined by the Chief Justice and Justices Alito, Gorsuch, Kavanaugh and Barrett. Justice Kagan dissented, joined by Justices Sotomayor and Jackson. The Court affirmed the Fifth Circuit’s judgment at 95 F.4th 263. It called the permitted methods, “government-issued identification and transactional data”, “plainly legitimate”.

SB 2420 (2025). The App Store Accountability Act was signed on 27 May 2025, with an effective date of 1 January 2026. When someone in Texas creates an account, an app store owner must “use a commercially reasonable method of verification to verify the individual’s age category”. The law sorts users into these age categories:

• child, under 13
• younger teenager, 13 to 15
• older teenager, 16 to 17
• adult

A minor’s account must be linked to a parent account. The store must get a parent’s consent before each download, purchase or in-app purchase. Developers must assign age ratings and use the store’s data to apply age restrictions. A violation “constitutes a deceptive trade practice”.

The trade group CCIA and a student group sued in October 2025. Judge Robert Pitman preliminarily enjoined the law on 23 December 2025. A preliminary injunction blocks a law while a case continues. He wrote that the law “is akin to a law that would require every bookstore to verify the age of every customer at the door”.

On 4 June 2026 a Fifth Circuit panel of Judges Smith, Haynes and Oldham granted Texas a stay pending appeal. The stay pauses the injunction while the appeal continues. The panel found that the district court “likely erred in applying strict scrutiny” because app listings “propose a commercial transaction”. The Supreme Court denied an application to vacate the stay on 6 July 2026. So the law is enforceable while the appeal continues. The Texas Tribune reported that CCIA expected an expedited Fifth Circuit hearing in early August 2026. We found no merits decision as of 31 October 2026.

What a VPN changes, and what it does not

HB 1181’s check is applied by the website. In practice it is applied to visitors who appear to be in Texas. A VPN replaces your IP address with the server’s. Your IP address is the number websites see for your connection. So a site that checks the age of Texas visitors will not check a connection that appears to come from elsewhere. A site that has blocked Texas altogether, as Aylo did in March 2024, will treat the connection as out of state.

That is the whole mechanism, and it is why demand moved when the block began. Newsweek reported that vpnMentor measured a 234.8 percent increase in VPN demand from Texas on 15 March 2024, the day after the block. It also reported that ExpressVPN saw a 35 percent rise in Texas use. We also searched for a Texas surge reported in March 2026. We found only the March 2024 figures repeated, so we do not claim one.

A VPN does not change the law that applies to the website or to you. It does not affect SB 2420 at all. The app store check runs when the account is created. It follows the account’s age category and consent status wherever the device connects from. A VPN also does not alter a payment card’s billing address. It does not stop a site that applies its check to every visitor, wherever they are.

For an adult, the exposure is contractual. A site can enforce terms of service that forbid evading age checks by suspending the account, and nothing in Texas law adds to that. Our is my VPN working? tool shows what a site sees. The best VPNs for privacy page covers what to look for in a provider.

Enforcement so far

Enforcement has run through the Attorney General and has been aimed at adult-site operators. On 26 February 2024 the office sued Aylo Global Entertainment, which runs several of the largest adult video sites. The office said it was “seeking an injunction against Aylo Global to require appropriate age verification safeguards and potentially millions of dollars in civil penalties”.

On 21 March 2024 it sued Multi Media LLC and Hammy Media on the same basis. It noted that Aylo had “disabled its website in Texas” rather than comply. The office’s releases set out the fine structure:

• “up to $10,000 per day”
• “an additional $10,000 per day if the corporation illegally retains identifying information”
• “$250,000 if a child is exposed to pornographic content due to not properly verifying a user’s age”

On 1 July 2026 the office announced what it called a landmark order. It is a writ, a type of court order, directing the .com registry operator to place a site’s domain on registry lock. Kick Online Entertainment runs the site. The office sued the company in April 2024. The company then ignored a default judgment and a permanent injunction. A default judgment is a ruling against a party that does not respond to a lawsuit. The company can recover the domain only by posting a $9.14 million bond “conditioned on implementing age verification that complies with Texas law and satisfying the civil penalties previously awarded”.

We did not find a published outcome in the Aylo, Multi Media or Hammy Media cases as of 31 October 2026. No enforcement action has been taken against a VPN provider or a VPN user. HB 1181 and SB 2420 give the state no basis for one.

What could change next

The Fifth Circuit’s merits ruling on SB 2420 is the next event. That is its decision on the appeal itself, after the stay order. If the court follows the reasoning of its 4 June 2026 stay order, app-store age verification will stand in Texas. Other states are then likely to copy it. If it affirms Judge Pitman, the check returns to the website level, where a VPN remains relevant.

HB 1181 itself is settled law after the Supreme Court’s decision. The Attorney General’s domain-lock order shows the office intends to enforce it against operators outside Texas. Nothing reported to us as pending before the Texas Legislature targets VPNs. No US state has proposed restricting adult VPN use. We re-check this page at least every 30 days and record each development in the timeline above.

Related

• VPN laws and age-verification tracker
• Age verification laws by state
• Age verification and VPNs: the global picture
• Is a VPN legal in the UK?
• Australia age verification and VPNs
• Best VPNs for privacy