Utah's VPN Law Did Not Take Effect Today: What SB 73 Actually Does to VPN Users

If you read the technology press this week, you saw some version of the same headline: the first US law targeting VPN use takes effect on September 3. That is the date Gizmodo put in its August 31 headline, and it is the date that spread through forums and social feeds over the weekend. It is also wrong, in two directions at once.

Utah’s Senate Bill 73 has been in force since May 6, 2026. Its VPN provision has been law for four months. What was scheduled to end on September 3 was not the law’s dormancy but a courtroom truce: a promise by Utah not to enforce the VPN clause against one company, Aylo, the operator of Pornhub, while a federal judge weighs the company’s challenge. And that truce was extended on August 27, a week before the headlines ran. Nothing changed today for anyone in Utah with a VPN app on their phone.

Here is what the bill says, whom it binds, where the case stands, and what any of it means for a person who uses a VPN.

Did Utah's VPN Law Take Effect on September 3?

No. The confusion comes from conflating two documents.

The first is the law itself. SB 73, the Online Age Verification Amendments, was sponsored by Senator Calvin Musselman and Representative Steve Eliason and signed by Governor Spencer Cox on March 19, 2026. Section 22 of the enrolled bill sets its effective date: May 6, 2026, with a handful of tax provisions following on October 1. The VPN language sits in Section 14, which amends Utah Code 78B-3-1002, and it carries the May 6 date like everything else.

The second document is a joint stipulation filed in federal court on April 27, 2026, five days after Aylo sued. In it, the Utah Division of Consumer Protection and the Utah Department of Commerce agreed to forbear enforcement of the “Deemed-Location Provision” against Aylo and its affiliates “until September 3, 2026, which is 120 days after the provision was otherwise scheduled to take effect.” Aylo, for its part, agreed not to change its current geofencing in Utah, meaning Pornhub and its sister sites would stay blocked for Utah IP addresses, as they have been since 2023.

That is where the September 3 date comes from. It was never an effective date. It was the expiry of a non-enforcement promise made to one litigant. And per the court docket, on August 27 the parties filed a further “Joint Stipulation for Extension of Non-Enforcement,” which the court acknowledged the next day. As XBIZ reported on August 28, the extension runs to October 22, 2026, or until the court decides Aylo’s motion for a preliminary injunction, whichever comes first. The stipulation frames the extra time around a Utah rulemaking: “this Period of Continued Forbearance allows Plaintiffs to participate in that rulemaking process without the threat of liability in the interim.”

So the accurate sentence is longer than a headline allows. The VPN clause is law, and has been since May. Utah has promised not to use it against Aylo until late October. For every other covered website, the clause has technically applied since May 6, though we found no public record of the Division opening an enforcement action against any site over VPN traffic.

What Does SB 73 Actually Require, and From Whom?

Utah has required age verification on adult sites since 2023. SB 73 rebuilds that regime: it adds public enforcement by the Division of Consumer Protection alongside the existing private right to sue, adds fines, creates an excise tax on covered sites, and adds two paragraphs about VPNs. Those two paragraphs, in the enrolled text, read as follows.

The deemed-location rule, new subsection (3) of 78B-3-1002: “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”

The facilitation ban, new subsection (4): a covered site “may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements,” including by providing “instructions on how to use a virtual private network or proxy server to access the website” or “means for individuals in this state to circumvent geofencing or blocking.”

Both rules are addressed to a “commercial entity that operates a website that contains a substantial portion of material harmful to minors.” Substantial portion has a number: more than 33 1/3 percent of the total material on the site. A site that brands itself as primarily adult, or uses an adult-themed domain, is presumed to cross that line.

The penalties are aimed at the same entity. Under new section 78B-3-1004, the Division’s director may impose an administrative fine of up to $2,500 for each violation, and a court can add a civil penalty of up to $2,500 per violation, disgorgement, injunctions and actual damages, plus up to $5,000 per violation for ignoring an order. Section 78B-3-1002(6) exempts internet service providers, search engines and cloud providers for merely carrying traffic, and subsection (5) exempts bona fide news and public-interest content.

Notice what is absent. There is no definition of “VPN user,” no duty imposed on a VPN provider, and no fine, offense or civil liability for an individual who connects through a VPN. The quotable version: Utah’s SB 73 does not regulate VPN users; it regulates websites, by declaring that a visitor physically in Utah counts as a Utah visitor no matter what IP address the site sees.

Is It Illegal to Use a VPN in Utah Now?

No, and it was not on May 6 either. Every operative clause of SB 73 names a commercial entity as the party with the obligation. A resident of Salt Lake City who turns on a VPN to use hotel Wi-Fi, reach a work network, keep an ISP from profiling their browsing, or watch a home subscription while traveling has done nothing the statute addresses.

What the law changes is the website’s exposure. Before SB 73, a covered site could argue that a visitor arriving from a Dutch or Canadian IP address was, for its purposes, in the Netherlands or Canada. Now Utah says the site is on the hook if that visitor was actually in Utah. Whether the site can know that is the next question, and it is the whole case.

How Is a Website Supposed to Know You Are in Utah If You Use a VPN?

It largely cannot, which is why the criticism of SB 73 comes from very different corners.

The Electronic Frontier Foundation called blocking VPN addresses “a technical whack-a-mole that likely no company can win”, noting that VPN providers add addresses constantly and no complete blocklist exists. Quoted by KUER in May, Fight for the Future’s Lia Holland put it more bluntly: determining where a user of a reputable VPN is browsing from is “literally impossible by design.” NordVPN, asked by Gizmodo, described the statute as a “liability trap” in which “platforms face real financial exposure for failing at a technical task no one currently knows how to perform reliably.”

The technical reasons are not controversial. IP geolocation is a commercial inference drawn from routing data and registration records, not a measurement of where a device sits, and it is routinely wrong at the state level even for ordinary connections. VPN and proxy detection relies on lists of known exit addresses that lag behind reality. And the same signals that flag a consumer VPN also flag corporate networks, university networks, mobile carriers that route traffic through out-of-state gateways, and privacy features built into mainstream browsers. A site that blocks everything that looks like a VPN blocks a large share of legitimate visitors, in Utah and everywhere else.

That is Aylo’s argument in a sentence: the only way to be sure of compliance in Utah is to verify the age of everyone, everywhere, which the company told the court would drive away up to 80 percent of its customers, or to block anyone who might conceivably be in Utah. Senator Musselman’s response, quoted by KUER, is that “SB 73 is about accountability,” and that sites can verify age or confirm location “while still preserving the encryption options for users.”

Utah’s own answer is arriving through rulemaking. SB 73 authorizes the Division to set age-verification standards by rule, with a safe harbor for sites that meet them. The Division’s proposed rule, R152-78B, is open for public comment until October 1 and is expected to take effect October 8, and according to XBIZ it includes standards for “geolocation obfuscation.” What those standards demand of a site will decide whether the deemed-location clause is a workable compliance target or an impossible one.

What Is Aylo's Lawsuit About, and When Will the Judge Rule?

Aylo Freesites and Aylo Group filed suit on April 22, 2026, in the US District Court for the District of Utah, case 2:26-cv-00340, against the Division of Consumer Protection, its director Katie Hass, the Department of Commerce and its executive director Margaret Busse. The case is before Judge David Barlow. The complaint targets the deemed-location provision specifically and argues, per Deseret News, that the clause “transforms what is nominally a Utah regulation into a de facto global mandate,” in violation of the Constitution’s limits on state regulation of interstate and foreign commerce.

Aylo is not challenging age verification as such. The Supreme Court settled that question in June 2025 in Free Speech Coalition v. Paxton, upholding Texas’s age-verification law. Aylo’s claim is narrower: a state may require age checks for its residents, but it cannot make a foreign company liable for visitors it has no reliable way to place inside the state.

The timeline so far, from the docket and the parties’ filings:

There is no announced date for the injunction ruling. The July 30 hearing transcript was filed on August 27, and the extension was framed by the parties around letting the rule land before the case moves. Expect the next real news in October, not September.

Which Other States Are Copying Utah's Approach?

Age verification for adult sites is now the norm in the United States. The Age Verification Providers Association counted at least 25 states that had passed such laws as of February 2026, and trackers updated over the summer put the number higher still. Utah was the second state in, with a law that took effect on May 3, 2023 and prompted Pornhub to block the entire state two days earlier. Google Trends showed VPN searches in Utah spiking to peak popularity in the early hours of May 2, 2023, as Newsweek reported at the time. That episode, more than anything, explains why the 2026 bill mentions VPNs at all.

Copying the VPN clause is another matter. Legislators in Michigan proposed going much further in 2025 with a bill that would have required ISPs to block VPN traffic outright; it stalled in committee. Wisconsin’s age-verification bill originally contained VPN language that was stripped in February 2026 before the governor vetoed the bill in April. Aylo’s complaint says no state had enacted a deemed-location clause before, and we found no other enacted US statute that names VPNs. The legislatures reported to be watching the case are waiting to see whether the deemed-location clause survives the injunction motion before drafting their own. That is the sense in which Utah is a test case: the outcome in Judge Barlow’s court will be read in two dozen other capitals.

What Should Someone in Utah Do About Their VPN?

Nothing, in the sense that no obligation has landed on you and none is proposed. A few practical notes, though, because the second-order effects of laws like this one are felt by ordinary users rather than by the sites they target.

1. Keep the VPN on for what it is for. Encryption on public Wi-Fi, a stable IP for banking and work logins, and a barrier between your browsing and your ISP are all unaffected. If you want a nearby exit, Le VPN runs a server in Salt Lake City alongside its other US locations, so a Utah-based connection can stay in Utah.
2. Expect more sites to challenge VPN traffic, everywhere. The rational response to a liability rule with no reliable detection is over-blocking. If a site that has nothing to do with Utah starts refusing your VPN connection, that is the compliance reflex spreading, not a sign that your VPN is doing anything wrong. Switching server is usually enough.
3. Do not take the law as a puzzle to solve. SB 73 bans covered sites from teaching visitors how to route around age checks, and this article is not going to do it for them. Age verification for adult content is constitutional and here to stay; the open question in Utah is only who bears the burden when the tools cannot tell where a person is.
4. Watch October, not September. The comment deadline on the rule is October 1, the rule may take effect October 8, and the enforcement truce with Aylo ends October 22 unless the court rules first. Any of those could change the practical picture, and none of them happened this week.

If you want the broader map of where VPNs are restricted and where they are simply regulated, our country-by-country guide to VPN legality in 2026 covers it, and our United States page lists the US server locations. For a European parallel, France’s regulator went through a very similar fight over adult-site age checks last year; we covered how that played out, including the same over-blocking dynamic that Utah is now importing.

The short version to pass along to anyone who sends you the headline: Utah’s VPN law is real, it has been in force since May, it regulates websites rather than people, and the date that matters next is October 22.