What SB 73 actually does starting September 3
SB 73, formally titled the “Online Age Verification Amendments,” was signed by Utah Governor Spencer Cox on March 19, 2026, after passing the state Senate 22-2 and the House 66-1. The law targets commercial entities whose websites contain a substantial portion, defined as more than one third, of material considered harmful to minors. Those sites must implement reasonable age verification methods before granting access to Utah users.
The novel piece is how the law treats VPN use. Under SB 73, anyone physically located in Utah is treated as a Utah user regardless of the IP address they present. A resident of Salt Lake City connecting through a VPN server in Germany is still, in the eyes of the law, a Utah user, and the website they visit remains liable for verifying their age. Sites are also barred from publishing instructions on how to use a VPN to circumvent the age gates. Penalties reach $2,500 per violation, with additional civil liability for platforms that fail to comply.
Why the industry says the law can’t function as written
The core objection is technical. Reliably detecting whether a visitor is using a VPN is a problem the industry has not solved at scale. Commercial VPN providers, residential proxy networks, rotating IP pools, and privacy-focused browsers all present connections that look, to a website, indistinguishable from ordinary traffic. Publishing a list of “known VPN IPs” to block is a moving target that changes daily, and blocking everything even resembling a proxy would sweep up legitimate users on corporate networks, mobile hotspots, and CGNAT connections.
NordVPN has been one of the more vocal industry voices on this point, characterizing the law as a liability trap: platforms face real financial exposure for failing at a technical task no one currently knows how to perform reliably. The Electronic Frontier Foundation has raised parallel concerns, describing the law as a “technical whack-a-mole” and flagging First Amendment issues with the ban on VPN-related information.
What SB 73 does not change for regular VPN users
This is the part that gets lost in the headlines: SB 73 is not a VPN ban. Ordinary VPN use in Utah remains fully legal. Using a VPN to secure your connection on public Wi-Fi at the Salt Lake City airport, to access your bank account remotely, to work from a coffee shop, to stream a service you subscribe to while traveling, or to prevent your internet provider from logging your browsing history: none of these use cases are affected by SB 73 in any way.
The law targets a specific interaction: adult websites subject to Utah’s age verification rules, and how they handle visitors who happen to be in Utah. For everyone using a VPN for the reasons the technology was built for, meaning privacy, security, and freedom on public networks, nothing changes on September 3.
Protect your connection with NordVPN
Why 26 other states are watching this rollout closely
Utah has been a testing ground for online age verification since 2023, when it became the first US state to require adult sites to verify user ages. That earlier law produced a predictable effect: VPN usage in Utah surged as users routed traffic through servers in other states. SB 73 is the legislative response to that workaround, and its outcome will shape what happens elsewhere.
At least 26 other states have age verification laws either in effect or under active consideration. Legal analysts and civil liberties groups have been open about treating SB 73 as a test case for whether VPN-targeting provisions can survive judicial scrutiny. If Utah’s law holds up in court, similar language will almost certainly appear in other state legislatures. If it gets struck down, the model changes for everyone. Either way, September 3 is the starting point.
Stay ahead of state VPN laws with NordVPN
Where NordVPN stands, and what it offers everyone else
NordVPN has been one of the more visible industry voices during the SB 73 debate, arguing publicly that the compliance model does not match the technical reality. Beyond the politics, the company remains one of the most established VPN providers on the US market. It operates over 7,000 servers across 118 countries, supports up to 10 simultaneous device connections per account, and runs the NordLynx protocol built on WireGuard for fast, modern encryption.
For a deeper look at how the service performs on the fundamentals like speeds, server network, and privacy stance, our NordVPN review goes through it in detail. NordVPN also holds a consistent spot near the top of our regularly updated best VPN guide, largely because of the company’s track record on both the product side and the policy side.
Get NordVPN Basic at $3.49/month
The plan behind the pushback: Basic at $3.49/month
NordVPN’s Basic plan is currently available at $3.49/month, which works out to $94.23 billed once for 27 months of service (24 + 3 free). That’s a 69% discount off the standard rate. Annual renewal continues at $139.08/year, cancelable from the account dashboard at any time.
The Basic plan includes the core VPN service across up to 10 devices, applications for Windows, macOS, Linux, iOS, Android, plus browser extensions and router installation for whole-household coverage. NordVPN also backs every plan with a 30-day money-back guarantee, so you have a full month to test the service on your setup, verify speeds on your connection, and see whether it fits before the refund window closes.
Refunds are full, processed through 24/7 chat support, and typically return within 5 to 10 business days. A note on the subscription: the $3.49/month rate applies to the first 27 months, after which auto-renewal kicks in at the standard rate. If you’d rather cancel or renegotiate before renewal, set a reminder in your calendar 7 to 10 days before the renewal date.