Utah’s Senate Bill 73 (SB 73), which officially went into effect on September 3, requires commercial websites that host adult content to verify the ages of their users. The law, known formally as the Online Age Verification Amendments, was briefly halted after a court issued an injunction, but it is now active. Utah has become the first U.S. state to specifically target the use of virtual private networks (VPNs) for age verification purposes. A VPN is a service that allows users to mask their real IP address and appear to be located in a different place online. Under SB 73, anyone physically present in Utah is considered a Utah user, regardless of the IP address they use to access a website. This means that even if a person in Salt Lake City uses a VPN to connect to a server in Germany, they are still legally viewed as a Utah user. Websites that fail to verify the age of users in Utah could face fines of up to $2,500 for each violation. The law has faced criticism from cybersecurity and digital rights organizations, who argue that it creates a complex and difficult-to-enforce system. Some experts have called the legislation a "dangerous precedent" and an "impossible by design" waste of resources. The law also prohibits adult content websites from providing instructions on how to use a VPN to bypass the state's age verification requirements. Major VPN providers have stated they plan to continue operating as usual in Utah. NordVPN’s privacy advocate, Laura Tyrylyte, noted that legal challenges to the law are still ongoing, and enforcement might remain paused during the litigation. She emphasized that the responsibility for compliance lies with the websites hosting the content, not the VPN companies. Similarly, AdGuard’s Head of Products, Denis Vyazovoy, said the company has no plans to restrict its users in Utah, as the law does not directly require VPN providers to comply. Surfshark’s Head of Legal, Gytis Malinauskas, warned that the law sets a troubling precedent by treating a key cybersecurity tool as a loophole. For now, the use of encryption remains legal in Utah. However, the responsibility for proving compliance has shifted to the website operators, who may be forced to implement invasive tracking methods or block all traffic that appears to come from a VPN to meet the law’s requirements.