A regulatory initiative in the U.S. state of Utah, formalized as law SB 73, introduces significant changes to the rules for online platforms handling adult content. Now, websites where the share of such material exceeds a set threshold are required to verify the age of every visitor located within the state—and this requirement extends even to those attempting to mask their real location through VPN services or proxy connections.
The Essence of the Legislative Act
A key aspect of the new law is the prohibition on facilitating the circumvention of checks. Internet resource operators are explicitly banned from providing tools or instructions that help users conceal their geolocation or otherwise avoid age identification. This implies that platforms must implement mechanisms capable of detecting and blocking traffic from anonymizing networks, rather than simply relying on standard IP detection.
Financial liability for violations is set at up to $2,500 per individual case. However, the law also includes an important restriction for third parties engaged in age verification: they are not permitted to store users' personal data after the verification process is completed. This requirement aims to minimize the risks of sensitive information leaks.
From a legal perspective, Utah's initiative fits into a broader trend of tightening adult content regulation in the U.S., but it goes further than previous attempts. For example, similar laws in other states often ignored technical means of anonymization, making them easy to bypass. Here, lawmakers have clearly taken into account the realities of the modern internet, where VPN has become a mass-market tool.
From my expert perspective: the effectiveness of SB 73 will depend on technical feasibility. Completely blocking VPN traffic is a complex task, since many legitimate users employ these tools to protect privacy, not just to bypass restrictions. This creates a risk of false-positive blocks and potential lawsuits from providers who may deem the requirements excessive. Nevertheless, the law sets an important precedent: regulators are beginning to view VPN not as a neutral tool, but as a vulnerability in the age-control system.