Utah has become the first state in the country to hold websites legally responsible for user access even when that access is masked by a VPN, creating a significant and largely unprecedented challenge for everyday internet users. Senate Bill 73, the legislation at the center of this shift, extends the state's age-verification framework in a way that no other state has attempted: rather than simply requiring websites to check user ages, it closes the workaround that location-masking tools have long provided. For the millions of Americans who rely on VPNs not for circumvention but for basic digital security, the implications extend well beyond age-restricted content.
What the Law Actually Does - and What It Doesn't
Senate Bill 73 does not ban VPNs. That distinction matters. What it does instead is shift legal liability onto websites, making platforms responsible for verifying user identity and age even when a visitor's true location is obscured. In practical terms, this creates a powerful incentive for websites to either block VPN traffic entirely or expand their identity-verification systems to apply to all users, regardless of whether they are actually in Utah.
That second outcome is the one privacy advocates find most concerning. Age-verification systems, by their nature, require the collection of personal data - government-issued identification, biometric checks, or third-party verification services. Expanding these systems to preemptively cover VPN users means collecting more data from more people, including those who have done nothing more than protect their own privacy. The law's indirect pressure on platforms could produce sweeping changes that affect users far outside Utah's borders.
The Legitimate Case for VPNs Has Never Been Stronger
VPNs - Virtual Private Networks - work by encrypting a user's internet traffic and routing it through a server in a location of their choosing, masking both the content of their activity and their geographic origin. This technology has never been the exclusive domain of users seeking to bypass restrictions. Remote workers use VPNs to secure corporate connections. Travelers and commuters use them to protect sensitive data on public Wi-Fi networks. Security-conscious individuals use them to limit how much data advertisers and data brokers can collect about their browsing habits.
These are not niche concerns. Data interception on unsecured networks is a documented and recurring threat. Advertiser tracking has become sufficiently pervasive that it forms the business model of a significant portion of the modern internet. Against that backdrop, legislation that creates structural pressure to diminish VPN access carries real costs for ordinary users - costs that have little to do with the content the law was designed to restrict.
Choosing a VPN That Holds Up Under Pressure
For Utah residents navigating this new environment, not all VPN services are equally equipped. The most important criteria right now are strong encryption, obfuscation capabilities that can disguise VPN traffic as regular internet traffic, a verifiable no-logs policy, and a wide enough server network to ensure reliable domestic access.
Several services stand out for meeting these criteria in different ways:
- NordVPN is the strongest all-around option. It offers Double VPN routing, obfuscation features specifically designed to evade VPN-blocking by websites, ad and tracker blocking, Dark Web monitoring, and servers covering all fifty U.S. states. It also leads on connection speed, which matters for streaming and everyday use.
- ExpressVPN is a close second. Following a significant U.S. network expansion - in part a direct response to the spread of state-level age-verification laws - it now maintains servers in every state. Speeds are consistently strong, platform support is broad, and its privacy record is well-established.
- Mullvad is the right choice for users who treat privacy as a first principle rather than a secondary feature. It requires no email address, no name, and accepts cash payment by mail. At a flat five dollars per month, it collects the minimum data necessary to function - which is to say, almost none. Server coverage is not nationwide, but it is sufficient for most use cases.
- Proton VPN is the only free VPN worth recommending without serious reservation. Operated by the Swiss-based Proton organization, it carries no advertising, imposes no data caps on its free tier, and has maintained a consistent privacy record. Free users are limited to one device and a small number of servers, including one U.S. location - which may itself be in a state with its own age-verification rules. The paid tier unlocks access to more than eleven thousand server locations worldwide.
A Regulatory Trend That Isn't Slowing Down
Utah is not acting in isolation. Multiple states have introduced or passed age-verification legislation over the past several years, and the legal pressure on websites to implement identity checks has grown steadily. What makes Senate Bill 73 different is its explicit recognition of VPNs as a variable to be controlled rather than ignored - a sign that legislators are becoming more technically literate about how users actually interact with the internet.
Whether that literacy produces good policy is another question. Privacy advocates and digital rights organizations have consistently argued that broad identity-verification mandates create data honeypots: concentrated stores of sensitive personal information that become high-value targets for breaches and misuse. The tension between protecting minors online and protecting everyone's digital privacy is real, and it is not resolved by legislation that simply transfers liability without addressing the underlying data risks. For Utah residents, the practical response in the near term is clear: use a reputable, well-audited VPN, understand what protections it actually provides, and treat it as one layer of a broader approach to personal digital security rather than a complete solution on its own.
