The law asks adult platforms to do something that every major VPN says can’t be done. Our news desk covered the rollout of the first US law targeting VPN use.
Disclaimer: This page is written for adults. Gizmodo supports Utah’s effort to keep explicit material away from minors. If you’re under 18, viewing this content is illegal in Utah. Our interest is the privacy of legal adults, whose identity documents now pass through third-party companies with their own breach history.
What SB 73 Changes on September 3
Governor Spencer Cox signed SB 73, formally the Online Age Verification Amendments, on March 19, 2026. It passed the Utah Senate 22-2 and the House 66-1, nearly unanimously for a contested bill. The law applies to commercial sites where more than a third of the material is considered harmful to minors. Those sites have to verify a visitor’s age before granting access, which Utah required under S.B. 287 in 2023.
The new part is how SB 73 defines a Utah user. A person physically located in the state counts as one, no matter which IP address their connection presents. A resident of Salt Lake City whose traffic exits a server in Germany is still a Utah user under the statute. The platform stays liable either way. Sites are also barred from publishing material explaining how a VPN interacts with these checks.
Penalties run to $2,500 per violation, with civil liability on top for platforms that fall short. The obligation falls on the website alone. Nothing in SB 73 creates a penalty for the person visiting it.
Why VPN Companies Say the Law Can’t Work
The objection is technical. Identifying whether a visitor is using a VPN is a problem the industry has not solved at scale. Commercial VPN traffic, residential proxy networks, rotating IP pools, and privacy browsers arrive at a website looking like ordinary connections. Blocklists of known VPN addresses change daily and are out of date as soon as they’re published.
Blocking everything that resembles a proxy would catch corporate networks, mobile hotspots, and every user behind carrier-grade NAT. That’s a large share of mobile traffic in any state. NordVPN has been the most vocal company on this, describing the law as a liability trap. Platforms take on financial exposure for failing at something the industry has no reliable method of doing.
The Electronic Frontier Foundation came to a similar conclusion, calling the approach technical whack-a-mole. It also raised First Amendment objections to the restriction on publishing VPN-related information. Neither argument disputes the goal. Both dispute whether the mechanism can function.
What SB 73 Doesn’t Change for VPN Users in Utah
This gets lost in the coverage: SB 73 is not a VPN ban. Using it in Utah remains completely legal, and the law creates no offence for a resident who uses one. Everything the technology was built for continues untouched. Securing a connection on airport Wi-Fi. Opening a work network from a coffee shop. Signing into a bank account while travelling. Stopping an internet company from logging which sites you visit.
None of that falls within the statute. The law covers one specific interaction, between adult platforms subject to Utah’s rules and the visitors those platforms serve. For the millions of people using a VPN for privacy and security, September 3 changes nothing.
What Verification Companies Collect
The privacy question deserves more attention, and it applies to adults who verify exactly as the law intends. Utah’s framework accepts several methods. A digital identity app such as Yoti. A webcam photograph analysed by software. A direct upload of a passport, driver’s licence or state ID. Each one sends government documentation, or a scan of your face, to a company you didn’t choose.
We worked through the Yoti method far enough to see what it asks. It wants a separate app installed and an account registered, a QR code scanned on the site you’re visiting, biometric data supplied, and agreement to terms permitting research use of that data. It then asks permission to share personal data with advertising partners. Yoti encrypts its data to the same standard a serious VPN uses.
That’s reassuring until you ask who else ends up with a copy. S.B. 287 instructs sites not to retain personally identifiable information once access is granted. That’s an instruction. Nothing enforces it technically. The 2025 breaches at several identity-verification vendors are the reason privacy groups keep raising this: a document that never leaves your possession can’t leak from a vendor’s server.
Which Platforms Operate in Utah Now
The market split in two after 2023, and SB 73 doesn’t change which side companies chose.
Aylo pulled its properties out of Utah instead of building verification systems, which is the same decision it took in Louisiana, Texas, South Carolina, Iowa, and a growing list of other states. Pornhub’s Utah presence is now limited to content creators signing into existing accounts, with no new registrations accepted. Other operators built the checks instead.
xHamster, Chaturbate and Brazzers each run a verification flow for Utah visitors, which is why they remain reachable while Aylo’s sites are not. Whether that pattern lasts past September 3 is the open question. SB 73 raises the compliance burden on companies that stayed, and withdrawal has so far been the cheaper answer for operators unwilling to take on the liability.
Best VPNs for Privacy in Utah
A VPN exempts no one from Utah law, and SB 73 is explicit that it doesn’t. What it does is keep your browsing away from your internet company, secure your traffic on networks you don’t control, and reduce how much of your activity is attached to your name by default. We tested more than 40 services this year. These 3 lead on privacy.
9200 servers
128 covered countries
30 days money-back guarantee
10 simultaneous connections
9.4 /10
20396 servers
148 covered countries
30 days money-back guarantee
10 simultaneous connections
9.2 /10
3000 servers
105 covered countries
30 days money-back guarantee
10 simultaneous connections
9.1 /10
1. NordVPN
Pros
- Panama base
- Breach scanner included
- 10 Gbps ports
- Post-quantum NordLynx
- Malware protection
- Audited 6 times
Cons
- Steep renewal rate
- Dedicated IP is paid
NordVPN operates more than 9,500 servers across 149 countries from Panama, which has no mandatory data retention. Its no-logs policy has been through 6 independent audits, the most recent by Deloitte in 2026. Servers run from volatile memory and are wiped clean on every reboot. Speed loss averaged 7.8% across our test locations, so encryption costs you almost nothing in practice.
Threat Protection Pro filters ads, trackers, and malicious domains, which matters more on adult sites than on most of the web given what the ad networks there attach to a session. The company has also been the loudest industry voice against SB 73, arguing publicly that the compliance model doesn’t match what’s achievable. That position is worth knowing when you’re choosing who handles your traffic.
Basic costs $3.49 a month, a single $94.23 payment covering 27 months, and renewal is $139.08 a year. A 30-day refund window applies to every plan.
2. Proton VPN
Pros
- Swiss data protection
- No-logs tested in court
- Anonymous signup
- NetShield DNS filtering
- Publicly audited code
- Uncapped bandwidth
Cons
- Smart DNS unavailable
- Setup guides run long
Proton VPN is the strongest choice for those whose main concern is who stores their data. It operates from Switzerland, outside the 5, 9 and 14 Eyes arrangements, with no data retention obligation on VPN companies. Every client is open source and publicly audited, so a security researcher can confirm the software does what the company claims. The no-logs position has been tested in a real proceeding.
When Swiss authorities requested user data in 2019, there was nothing relevant to hand over. Sign-up accepts cash and doesn’t require a name. Across 20,000+ servers in 148 countries, bandwidth is uncapped, and P2P is permitted on most of the network. Pricing is $2.99 a month over 2 years, $71.76 for the term, with a 30-day refund window.
3. ExpressVPN
Pros
- KPMG-audited no-logs
- TrustedServer volatile memory
- Threat Manager filtering
- Browser privacy tools
- Wide platform support
Cons
- Costs more monthly
- Fewer configuration options
ExpressVPN is the simplest of the 3 to live with. The apps are close to self-explanatory, the connection takes one button, and there’s little to misconfigure, which is its own kind of privacy protection. TrustedServer operates every server from volatile memory with no hard drives involved, and KPMG reviewed both that architecture and the privacy policy in February 2025.
Threat Manager blocks tracker connections at the network level, and the apps cover 113 countries across 214 locations. Basic works out to $2.99 a month across 28 months, a one-off $83.72, renewing at $99.95 yearly. Every plan includes a 30-day refund window.
Where the Other States Stand
Utah has been the testing ground for online verification since 2023, when it became the first state to require it. At least 26 others now have comparable laws in force or moving through their legislatures, and Iowa’s took effect on July 1, 2026. SB 73 is a different proposition, and legislators elsewhere are treating it as one.
It’s the first attempt to write VPN traffic into the definition of who counts as a local user, and its survival in court decides whether that language spreads. If it stands, similar wording appears in other states within a session or two. If it’s struck down, the model has to be rebuilt.
Australia and France have gone the same way at national level, with Aylo withdrawing from both. Spain is weighing comparable rules. The pattern is consistent enough that September 3 reads less like a Utah story than an early one.
Conclusion
SB 73 arrived on September 3 as the first US law to name VPN traffic in a verification statute, and it does so with a technical requirement the industry says it cannot meet. Platforms take the liability, at $2,500 per violation. Residents take none. For adults in Utah, the question isn’t the law itself but what verifying costs in privacy.
Handing a passport or a face scan to a third-party company, one you didn’t choose and can’t audit, is an exposure, and the vendor breaches in the past year are the argument for taking it seriously. A VPN doesn’t change your obligations under Utah law. It hides your traffic from your ISP and protects it on networks you don’t own, which is why we’ve covered the 3 strongest options above.
Our wider VPN rankings go further if privacy is the reason you’re here.
Utah FAQ
⚖️ Is it legal to watch porn in Utah?
Yes, for adults. The law places the obligation on websites, which must verify visitors before granting access. Minors remain prohibited from viewing this material, and SB 73 leaves that part of the rule unchanged.
❌ Does SB 73 ban VPNs in Utah?
No. The statute regulates adult websites and how they treat visitors located in the state. It creates no offence for residents, and ordinary use for privacy, security, or remote work stays legal.
🏛️ What penalty does SB 73 impose?
Up to $2,500 for each violation, plus civil liability. The exposure attaches to the platform, which stays responsible for verifying a visitor located in Utah no matter which IP address that connection presents.
🗂️ What do verification companies collect in Utah?
It depends on the method. A digital identity app requires biometric data and a registered account. Facial estimation uses a webcam image. The third option means uploading a passport, licence, or state ID.
🔎 Which other states have laws like Utah?
At least 26 have measures in force or under consideration, with Iowa's starting on July 1, 2026. Texas passed comparable rules earlier, and the same withdrawal pattern followed there.