Utah Age Verification Enforcement: What It Means for VPNs

Utah began enforcing its age verification law for adult websites on 2 November 2026. The Department of Commerce announced the date in a news release on 30 October. Margaret Woolley Busse, the state’s Commerce Commissioner, gave the same date to Fox 13 News that day. The law is S.B. 73, the Online Age Verification Amendments of 2026. The part of it that treated VPN users in Utah as Utah visitors stays blocked by a federal court. Using a VPN in Utah is still legal.

We checked the release and the report against the law and the court order. The release says the court order “applies solely to” subsection 3, the VPN location rule. It gives no fine amounts. The fines Busse described to Fox 13 match the text of S.B. 73.

What happened

S.B. 73 took effect on 6 May 2026. It covers a site when more than a third of its material is harmful to minors. Such a site must verify the age of visitors from Utah. The Division of Consumer Protection enforces the law. Its director can fine a site up to $2,500 for each violation. A court can add a civil penalty of up to $2,500 for each violation. A site that breaks an administrative or court order faces up to $5,000 for each violation.

On 24 September 2026, Judge David Barlow blocked one part of the law. That part is subsection 3 of Utah Code section 78B-3-1002. It treated a visitor who is physically in Utah as a Utah visitor even when a VPN hides their location. The case was then paused until after Utah’s 2027 legislative session. Our earlier report explains the ruling.

Busse told Fox 13 that her agency will check sites that present themselves as adult sites and where more than a third of the content is pornographic. It wants real age checks, not a button that asks visitors to confirm they are 18. “Every single violation can be up to $2,500,” she said.

The release says the department has set up “specialized computing and auditing infrastructure developed by enterprise technology partners”. State investigators will use it to check whether covered sites verify ages. They can then start enforcement actions.

The bill’s sponsor, Senator Calvin Musselman, told Fox 13 he is working on a revision to answer the judge’s concerns about VPNs. He said that blocking VPN use “might not be achievable”.

Why it matters

For VPN users, the legal position does not change. S.B. 73 puts its duties and fines on websites, not on visitors. No part of it makes using a VPN an offence.

The pressure is on the sites. With subsection 3 blocked, the law no longer says that a Utah resident on a VPN server outside the state counts as a Utah visitor. Fox 13 notes that some large adult sites already block Utah IP addresses in protest at the law.

One VPN rule is still in force. Subsection 4 bars covered sites from helping visitors use a VPN or proxy to get around age checks, including by publishing instructions. It was not part of the court challenge. Neither the department’s release nor Fox 13’s report says whether the agency will act under it.

The Free Speech Coalition, a trade group for the adult industry, told Fox 13 it has asked its member sites to follow the parts of the law the court left in place.

What to do

If you live in Utah and use a VPN, you do not need to do anything. The law does not apply to you as a user. From 2 November, more sites may ask visitors from Utah for proof of age, and some may refuse them. Before you upload an ID or a face scan, check who runs the age check and what it keeps.

• Our age verification hub explains how these checks work and what a VPN changes.
• Our state-by-state tracker lists each US law and its status.

What we changed

We added the 2 November enforcement date to the timeline and to the enforcement section of our US laws page. We added it to the timeline of the age verification hub too. Both pages still say that using a VPN is legal in every US state.

Correction, 5 November: an earlier version of this article said the Department of Commerce had posted no statement on its website. It had announced the date in a news release on 30 October, which we missed. The release is now our primary source.