Utah passed a law that makes websites responsible if users use a VPN to skip age checks. The law started on May 6, 2026. But a federal lawsuit has paused it until September 3.
SB 73 Started May 6, Then a Lawsuit Paused It Until September
Utah Governor Spencer Cox signed Senate Bill 73 on March 19, 2026. It is the first US law that targets VPN users in age checks. The rule has two parts. First, if a user is in Utah, the law treats them as a Utah user, even if a VPN hides their IP. Second, websites with content harmful to minors cannot tell users how to use a VPN to skip age checks.
The parent company of PornHub, Aylo Freesites, sued Utah in federal court before the rule took effect. The state then agreed to pause the VPN provision until September 3, 2026, while the case continues. The Salt Lake Tribune reported the pause.
Critics Say Most Websites Cannot Spot VPN Users on Their Own
The Electronic Frontier Foundation says Utah is the first US state to hold websites legally responsible for users who slip past age gates with a VPN. NordVPN called the rule an “unresolvable compliance paradox” and a “liability trap,” as TechRadar reported. Digital rights groups argue that the law punishes sites for failing to catch tools that are designed to be hard to catch.
The law also fits a bigger pattern. Many US states have passed age check rules in the last two years. The UK, France, and Australia are also pushing platforms to keep minors out of adult content.
VPN Detection Is Already a Standard Feature for Specialist Vendors
The technical worry is real for most websites. Free IP lists, like MaxMind, can flag known datacenter IPs. But commercial VPNs change their IPs all the time, and home VPN traffic looks like a normal home connection, as PC Gamer reported. So most sites that try to handle age checks on their own cannot easily spot a VPN user.
That gap is not the same for everyone. Specialist age verification vendors already build VPN and proxy detection into their core tools. They run several checks on each session at the same time: IP risk scoring, datacenter and proxy lists, device signals, and network type. The result is that VPN detection is not impossible. It is just hard for sites to do alone, which is why dedicated vendors exist.
Shufti’s Age Verification Already Detects VPN Users at the Gate
Utah’s new law is exactly the kind of rule that calls for a dedicated age verification vendor. Shufti’s age verification platform already includes VPN and proxy detection as part of its standard age check flow. It also combines AI-based face age estimation and document verification in a single session. The platform supports 240+ countries and is KJM-certified in Germany, the first regulator-approved age check standard for adult content in Europe.
Sites operating in Utah and in the growing list of states and countries with age check laws can explore Shufti’s age verification solution or request a demo to see how it handles VPN users in real time.
