If you look for the number of US states that require age verification for adult sites, you will find 25, 26 and 27, published within weeks of each other and all presented with confidence. The most recent reporting, in September 2026, puts it at 27.
The disagreement is the interesting part, and it is not carelessness. It tells you something about how these laws work that a clean number would hide.
Why the count moves
Effective dates are staggered. A law signed in March may take effect in May, in September, or on the first day of the following year. A list is accurate on the day it was written and starts drifting immediately.
Some laws are in force and not being enforced. Utah's SB 73 took effect on 3 September 2026, and the state's Department of Commerce has committed not to enforce it while a federal challenge is pending. Whether a tracker counts that state depends on whether it counts the text or the practice. Both choices are defensible and they give different totals.
The scope differs between trackers. Age verification for adult content and age verification for social media are two separate families of statute. Some lists merge them, some do not. That alone accounts for several states of difference.
So the honest form of the answer is: around 27, as reported in September 2026, counting adult content statutes on the books. Anyone giving you a number without a date and a definition is giving you something you cannot check.
The stated purpose of every one of these statutes is this scene. Whether the mechanism they chose reaches it is exactly what the litigation is about.
What the laws actually require
The pattern is consistent across states, and it is narrower than the headlines suggest.
A commercial entity whose site contains a substantial portion of material deemed harmful to minors must verify that visitors from that state are adults before granting access. The threshold is commonly written as more than one third of the content. Verification is done by an ID check or through a third party service.
The duty sits on the website. The penalty sits on the website. None of these statutes creates an offence for the person visiting, and none of them requires anything of you. This is the part most coverage blurs, and it changes what the laws mean in practice: they are rules about what a business must do, not rules about what a citizen may read.
The one state that did something new
Utah is worth separating from the group. SB 73 is the first to name VPNs in the text, by defining a Utah user by physical location rather than by IP address. A resident connecting through a server elsewhere is still, under the statute, a Utah user, and the site still carries the duty.
That is a change to what a website can argue, not a change to what a person may do. We covered the text, the liability and the litigation in what Utah SB 73 actually does. The same cycle of coverage and confusion happened with the UK's rules and Australia's, and at federal level with the SCREEN Act.
What a VPN does and does not do here
Three things get merged whenever this comes up, and separating them answers most of the question.
A VPN changes the IP address a site sees. That is real and none of these statutes changes it.
A VPN does not change where you physically are, and it has never claimed to. Where a statute defines the user by location, as Utah's does, the tunnel does not operate on the thing the law cares about.
A VPN is not a legal position. It cannot discharge a duty, and it does not need to discharge yours, because none of these laws gives you one.
See NordVPN's current offer
Worth being explicit: a VPN protects your traffic and your address on networks you do not control. It is not an answer to a state age verification statute, which places its duty on websites rather than on visitors. Buy one for what it does.
How to check your own state without trusting a list
Lists go stale, including this page. Two checks that do not:
- Search your state's legislature site for the bill, not the news coverage. The text tells you the threshold, the effective date and who carries the duty. Coverage often gets all three wrong at once.
- Check whether the law is being enforced, not only whether it exists. Utah is the live example of a statute in force whose enforcement is paused. That distinction decides what actually happens to you today, and it never appears in a state count.
What to take from it
- The number is around 27 and it will be wrong soon. Take the date with it or do not take it.
- You are not the target of any of these laws. The obligations run to commercial sites.
- Utah's location clause is the thing to watch, because if it survives court scrutiny the wording will be copied.
- A paused law is not a struck down law. It can start being enforced without any ruling at all.
Figures reflect published reporting as of September 2026, which we cite rather than a count we compiled ourselves; sources published during 2026 range from 25 to 27 states. We describe what these statutes do and decline to offer circumvention advice. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.
Stay connected anywhere with NordVPN
Obfuscated servers for restrictive networks · 60+ countries · 30-day money-back
