Utah's VPN Law Takes Effect September 3: What SB 73 Actually Does (2026)

On 3 September 2026, Utah's Senate Bill 73 takes effect. It is being described as the first US law to target VPN use, and that description is doing a lot of work. The law does not ban VPNs. It does not penalise you for running one. Understanding what it actually says matters more than the headline, because the headline is producing a lot of advice that does not follow from the text.

What the law says

SB 73 is an age verification statute. It applies to commercial entities whose sites contain a substantial portion of material deemed harmful to minors, with substantial defined in the text as more than one third. Those sites must verify the age of Utah users before granting access.

The provision that makes it novel is the definition of a Utah user. Someone physically located in Utah is a Utah user regardless of the IP address they present. A resident of Salt Lake City connecting through a server in Frankfurt is still, under the statute, a Utah user, and the covered site still carries the verification duty. The law also bars covered sites from publishing instructions on using a VPN to bypass their own age gate.

The bill was signed by Governor Spencer Cox on 19 March 2026, having passed the state Senate 22 to 2 and the House 66 to 1. Its original May start date was paused by a court injunction, which is why it arrives in September.

Salt Lake City at night, the Capitol lit in the foreground. SB 73 was passed here in March 2026 and takes effect on 3 September.

Where the liability actually sits

This is the part most coverage blurs, so it is worth stating plainly.

The duty is on the website, not on the visitor. SB 73 creates no offence for the person connecting. It creates an obligation for a covered commercial site to verify, and a liability if it does not. Nothing in it turns a VPN user into an offender.

What the VPN clause does is close a defence the site might otherwise have raised. Before this language, a site could argue that an IP address from outside Utah meant no Utah obligation arose. The statute removes that argument by defining the user by physical presence instead. It is a change to what a website can claim, not a change to what a person may do.

What a VPN does and does not do here

Three separate things get merged whenever this topic comes up, and separating them answers most of the questions.

A VPN changes the IP address a site sees. That is real, it still works, and SB 73 does not alter it in any way.

A VPN does not change where you physically are. Nor does it claim to. Since the statute defines the user by location rather than by address, the tunnel simply does not operate on the thing the law cares about.

A VPN is not a legal position. It cannot discharge a duty, and it does not need to discharge yours, because you were never assigned one. Anyone selling you a VPN as protection from this law is selling you a solution to a problem you do not have.

Utah is not the first jurisdiction to put age verification and VPNs in the same sentence. The UK's age verification rules and Australia's went through the same cycle of coverage, and the same confusion between a duty on sites and a rule for users.

Why this one is being watched

Utah is not the only state legislating on age verification, but it is the first to write VPNs into the text. That makes SB 73 a test case rather than a local rule. Around twenty seven states now have a statute of this family, and published counts disagree with each other for reasons worth understanding: which US states require age verification, and why nobody agrees on the number.

If the VPN language survives judicial scrutiny, the wording will very likely be copied into other state bills, and the practical question for anyone running a covered site becomes how to determine physical location at all. If it is struck down, the drafting model changes for everyone working on this.

Neither outcome is known today. The law takes effect on 3 September; the litigation around it is not finished. We will update this page when there is a ruling to report rather than a prediction to offer.

Update, 7 September: the law is in force and is not being enforced

SB 73 took effect on 3 September 2026, on schedule. Four days on, the situation is stranger than either headline suggests.

Utah's Department of Commerce has committed not to enforce the law while the federal challenge is pending, and that commitment covers the statute as a whole rather than the VPN clause alone. The challenge is brought by Aylo, the parent company of Pornhub, which is the same litigation that pushed the effective date from 6 May to 3 September. At a hearing last week the judge declined to commit to any timetable for a decision, so there is no date to watch.

So both of the obvious readings are wrong. "The first US anti-VPN law is now in force" is technically true and practically misleading. "Nothing happened" is also wrong: the text is on the books, the obligations exist, and only a voluntary undertaking by the agency that would enforce them is holding the line.

What that means if you are reading this from Utah. Nothing changes for you today, for the same reason as before: no obligation under SB 73 falls on a VPN user. What changed is the position of the covered sites, which now face a live statute whose enforcement has been suspended by the enforcer rather than by a court order striking it down. That is a weaker protection than an injunction, and it can end without a ruling.

This update reflects published reporting on the September hearing rather than a court document we have read ourselves. We will revise it again when a ruling exists.

What to take from it, if you are not a lawyer

• You are not the target. No obligation and no penalty falls on you as a VPN user under SB 73.
• The scope is narrower than the headlines. Covered sites are those with more than a third of their content deemed harmful to minors. Ordinary browsing is untouched.
• Location, not IP, is the legal test. This is the genuinely new idea, and it is the one worth remembering as other states draft their own bills.
• Watch the courts, not the commentary. The injunction that delayed this law from May to September is a reminder that the text on the books and the law in force are not always the same thing.

Reporting based on published accounts of Utah SB 73, its legislative history and its 3 September 2026 effective date. We describe what the statute does and decline to offer circumvention advice, which would be both outside our remit and contrary to the law being discussed. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.