First US VPN Law Lands As Australia Weighs Similar Approach

Utah has become the first US state to enforce a law that explicitly targets the use of virtual private networks (VPNs) in the context of online age verification, with Senate Bill 73 taking effect on September 3.

The law, formally titled the “Online Age Verification Amendments,” was signed by Utah Governor, Spencer Cox, after passing the state Senate 22-2 and the House 66-1. It was originally scheduled to come into force in May but was paused by a court injunction following a legal challenge from Aylo, the parent company of Pornhub. That injunction has now expired.

The rollout has drawn opposition from civil liberties organisations, VPN providers and privacy advocates, who argue the law creates obligations that are technically impossible to meet and sets a troubling precedent for digital privacy in the United States and beyond.

For Australian observers, the developments in Utah carry particular relevance, as Australia’s eSafety Commissioner is weighing whether to impose similar requirements on platforms operating under the country’s own age verification regime.

What the law requires

SB 73 targets commercial entities whose websites contain material deemed harmful to minors, defined under the legislation as comprising more than one-third of a site’s content. Those sites must implement age verification measures before granting access to users located in Utah.

The law’s distinguishing feature is how it treats VPN use. Under SB 73, anyone physically located in Utah is considered a Utah user regardless of the IP address their connection presents. A resident of Salt Lake City routing their traffic through a server in another country remains, in the eyes of the law, subject to Utah’s age verification requirements, and the website they visit remains liable for verifying their age.

The legislation also prohibits affected sites from publishing instructions on how to use a VPN to circumvent age gates. Penalties reach $2,500 per violation, with additional civil liability for platforms that fail to comply.

Technical concerns dominate industry pushback

The primary objection from the technology industry centres on technical feasibility. Reliably detecting whether a website visitor is using a VPN to mask their location is a problem that has not been solved at scale.

Commercial VPN providers, residential proxy networks, rotating IP pools and privacy-focused browsers all present connections that can appear indistinguishable from ordinary traffic to a receiving website. Maintaining a blocklist of known VPN IP addresses is impractical given the rate at which providers add and rotate addresses.

Blocking everything that resembles proxy traffic would also sweep up legitimate users on corporate networks, mobile hotspots and carrier-grade NAT connections.

The Electronic Frontier Foundation (EFF) has described the compliance challenge as “technical whack-a-mole,” arguing that no comprehensive blocklist exists and that the law’s requirements would demand capabilities no company currently possesses.

The EFF has also characterised the law as a “liability trap,” warning that if a website cannot reliably detect a VPN user’s true location but remains legally required to do so, the resulting legal exposure could push sites to either block all known VPN IP addresses or mandate age verification for every visitor globally.

Such an outcome would subject millions of users worldwide to invasive identity checks or blocks on their VPN access, regardless of where they live.

Free speech implications

Beyond the technical hurdles, the legislation raises US First Amendment concerns. By prohibiting affected websites from sharing information about VPN use, the law prevents platforms from providing factual information about a lawful privacy tool.

The EFF has argued that this amounts to a gag order on speech about legitimate technology, describing SB 73’s enforcement approach as operating under a “don’t ask, don’t tell” framework. Under this model, websites likely only face an obligation to request proof of age if they become aware that a user is physically located in Utah and is using a VPN. If a site does not know a user is in Utah, its broader obligation to police VPN connections remains unclear.

The Cato Institute has weighed in on the broader policy direction, arguing that when an internet policy can be circumvented by a common technology that provides privacy and security benefits, the policy itself may be the problem rather than the technology being used to avoid it.

Workarounds likely to emerge quickly

Privacy advocates have warned that the law is unlikely to achieve its intended effect. If commercial VPN providers are successfully targeted, users will transition to alternatives including non-commercial proxies, private tunnels through cloud services and residential proxies that are virtually indistinguishable from standard home internet traffic.

The EFF has argued that these workarounds would emerge within hours of the law taking effect, while the collateral damage would fall on businesses, journalists and abuse survivors who rely on commercial VPNs for essential data security.

The organisation contends that the provisions are unlikely to prevent a technically proficient teenager from accessing restricted content, but will have a measurable impact on the privacy of ordinary Utah residents who use VPNs to keep their data away from brokers and malicious actors.

Twenty-six states are watching

Utah has served as a testing ground for online age verification since 2023, when it became the first US state to require adult sites to verify user ages. That earlier law produced a predictable result: VPN usage in Utah surged as users routed traffic through servers in other states. SB 73 is the legislative response to that workaround.

At least 26 other US states have age verification laws either in effect or under active consideration. Legal analysts and civil liberties groups are openly treating SB 73 as a test case for whether VPN-targeting provisions can survive judicial scrutiny.

If Utah’s law holds up in court, similar language is expected to appear in other state legislatures. If it is struck down, the model changes for jurisdictions across the country.

The broader legislative landscape in the US is active. The US Senate Commerce Committee has been considering multiple bills that touch on age verification and online privacy, including the KOSA bill, the SCREEN Act, the Youth AI Privacy Act and the CHATBOT Act – all of which the EFF has flagged as raising privacy concerns.

California’s legislature passed Assembly Bill 1709, which functions as a ban on social media use for people under 16, though the EFF has urged Governor, Gavin Newsom, to veto the bill. Illinois has passed its own device-level age-gating framework, and the EFF has similarly urged a veto from that state’s Governor.

Australia considering a similar path

The developments in Utah are being closely watched in Australia, where the eSafety Commissioner is considering whether to require social media and adult content platforms to block users attempting to connect via VPN.

Australia’s eSafety Commissioner, Julie Inman Grant, has led the country’s push to enforce age restrictions online, including an under-16 social media ban and under-18 checks on adult content sites.

The Commissioner’s own research found that only a third of young children with social media accounts stopped using them when the ban came into place. Meanwhile, the introduction of age checks on adult content sites triggered a surge in VPN installations across the country, with a range of VPN services climbing into the top 20 iPhone apps in the days following the block’s introduction.

Documents obtained under Freedom of Information laws indicate that the eSafety Commissioner expects platforms to actively block workaround tools including VPNs. The documents state that service providers must take reasonable steps to prevent workarounds and that the Commissioner will examine this when assessing compliance with codes.

Rather than banning VPN services outright, Australia is considering demanding that affected websites and platforms block users attempting to connect via VPN – an approach the United Kingdom briefly considered earlier this year before abandoning it due to concerns about the wider impact on privacy and security.

Australia’s history with VPN workarounds

Australian technology observers have noted that the country has a long history with exactly this type of enforcement challenge. During the geo-blocking disputes of the previous decade, Australian users routinely used VPNs to access overseas streaming services including Netflix and Hulu before those platforms launched locally.

That period saw a cat-and-mouse dynamic play out between streaming services attempting to block VPN traffic and users finding workarounds, often with the quiet assistance of VPN providers configuring less prominent servers to evade detection.

A similar pattern played out when Australian internet providers were required to block access to sites like The Pirate Bay. Users simply routed around the blocks using VPNs and SOCKS5 proxies.

Privacy commentators have argued that a social media VPN crackdown would follow the same trajectory, with workarounds available for those willing to persist and some VPN providers willing to quietly assist, while officials declare the measure a success because fewer users appear to be getting through.

VPN safety concerns add another layer

Complicating the picture further are concerns about the safety of VPN applications themselves. Research from VPN provider, Proton, has found that 85 per cent of mobile VPN apps downloaded in the US contain trackers designed to collect and share user data, including device identifiers, device models, network types and mobile carrier information.

The research identified 64 of 390 VPN apps available on the Apple App Store and Google Play in the US as being owned by Chinese companies. Chinese law can compel companies to cooperate with intelligence authorities, raising questions about how user data flowing through those services could be accessed.

Proton’s analysis found that 64 of the apps examined actively track users’ physical locations using GPS and geolocation data. The company characterised VPN apps that secretly track users as representing an “ultimate act of betrayal” of user trust.

The findings highlight a tension at the heart of the VPN debate: laws that push users away from established commercial VPN providers may drive them toward free or lesser-known services that pose greater privacy risks than using no VPN at all.

Surveillance concerns compound the debate

The VPN policy debate in the US has also intersected with concerns about government surveillance. Six Democratic lawmakers have pressed the Director of National Intelligence to disclose whether Americans who use commercial VPN services risk being classified as foreigners under US surveillance law, a designation that would strip them of constitutional protections against warrantless government surveillance.

The question of whether VPN use could expose Americans to surveillance under Section 702 of the Foreign Intelligence Surveillance Act adds another dimension to the policy debate, particularly as states move to regulate or restrict VPN use in other contexts.

What the law does not do

SB 73 is not a VPN ban. Ordinary VPN use in Utah remains legal. Using a VPN to secure a connection on public Wi-Fi, to access banking services remotely, to work from a public location or to prevent an internet provider from logging browsing history is unaffected by the law.

The legislation targets a specific interaction: adult websites subject to Utah’s age verification rules and how those sites handle visitors who are physically located in the state.

For users relying on VPNs for privacy, security and data protection, nothing changes under SB 73. The law’s scope is limited to the age verification context, though critics argue its precedent-setting nature means its implications extend well beyond Utah’s borders.

As the law takes effect, its performance in court and its practical impact on the ground will shape the direction of VPN policy across the US and in countries including Australia that are grappling with similar enforcement challenges.

Discuss this on Reddit.

Last Updated on September 1, 2026 by Nick Ross