Utah’s VPN Law Explained: How to Stay Private Online Legally in 2026

Imagine trying to watch a movie at a theater, but the usher checks your ID at the door—even for PG-13 films.

That’s what Utah’s new law feels like for the internet. Earlier this year, confusion spread online when headlines screamed, "Utah bans VPNs!" But here's the truth: Utah didn't ban VPNs. In 2026 it changed its age-check law for adult websites so that those sites, not their visitors, have to deal with people who connect through a VPN. Then, on September 24, 2026, a federal judge put that VPN part on hold (KUER).

If you don’t live in Utah, you might be thinking, "Why should I care?" Here’s why: This law could be the first domino to fall. Other states (and even the federal government) are watching closely. If it works in Utah, they might try something similar. Plus, it’s a wake-up call to understand how your online privacy really works—and how to protect it without running afoul of the law.

The law is part of a broader push to keep adult content away from minors. But critics, including the Electronic Frontier Foundation, argue it backfires by making privacy tools harder to use for everyone. So, what does this law actually say? Who does it affect? And how can you stay private online without breaking the rules? Let’s break it down.

Where things stand (sources checked October 9, 2026): Using a VPN in Utah is legal. Adult websites still have to check the age of visitors in Utah under the state's 2023 law. The 2026 rule that told those sites to treat anyone physically in Utah as a Utah visitor, even behind a VPN, is blocked by a preliminary injunction while the court case continues (court decision, September 24, 2026). This is general information, not legal advice.

---

1. What Does Utah’s VPN Law Actually Say?

Photo by David Solce on Pexels

First, let's clear up the confusion. Two Utah laws matter here, and neither one bans VPNs.

• SB 287 (2023). Since May 3, 2023, websites where more than a third of the content is pornographic have had to check that visitors in Utah are adults, using a digital ID, a government ID or another commercially reasonable method. A site that skips the check can be sued for damages (AVPA state table).
• SB 73 (2026), the "Online Age Verification Amendments." Governor Spencer Cox signed it on March 19, 2026. Most of the bill sets up a 2% tax on adult-content revenue starting in October 2026. Its VPN section, which took effect on May 6, 2026, does two things (EFF):
  • It says a person who is physically in Utah counts as a Utah visitor "regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location" (court decision).
  • It bars those adult sites from encouraging people to use a VPN to get around the age check, including by posting instructions on how to do it.

Notice who the rules are aimed at: the websites. The court described the law as putting liability on the commercial site that fails to check the age of a visitor who is actually in Utah, and SB 73 does not ban using a VPN. As Gizmodo put it, SB 73 "is not a VPN ban and ordinary VPN use in Utah remains fully legal."

Think of it like a bar that has to card everyone who walks in. Utah's 2026 change told the bar it must also card people who come in through the side door. Checking IDs is the bar's job, and the bar is the one that pays if it gets it wrong. You can still use a VPN for streaming, work, or general privacy.

Who does this affect?

• Adult websites that people in Utah can reach. The duty to check ages, and the liability, sit with them.
• Adults in Utah who visit those sites, because the sites must check their age.
• Parents worried about kids bypassing age checks.
• Privacy-conscious users who don’t want to hand over their ID to every website.

What’s not illegal?

• Having a VPN, or using one in Utah. SB 73 is not a VPN ban.
• Using a VPN for other reasons, like streaming, work, or general privacy.
• Accessing non-adult sites with a VPN.
• Using a VPN in other states (for now).

If you’re not in Utah, you don’t need to worry—yet. But this law could be a sign of things to come in other states.

Where SB 73 stands now

The VPN part has spent most of its life on hold:

• March 19, 2026: Governor Cox signs SB 73 (EFF).
• April 22, 2026: Aylo, the company behind Pornhub, sues to block the VPN rule (court decision).
• May 6, 2026: The VPN section takes effect. In May, Utah agrees not to enforce it until September 3, 2026 (EFF).
• Early September 2026: Once that date passes, the state agrees with Aylo not to enforce the law while the judge decides (Gizmodo; EFF).
• September 24, 2026: Judge David Barlow grants a preliminary injunction that blocks the VPN location rule. He found it "undisputed" that perfect geolocation is not possible today, and said the law as written would require sites to "geolocate its website users with perfection to avoid liability" (KUER).

The injunction covers only that location rule. Aylo did not challenge the 2023 age-check requirement in this case, and it still applies (court decision). Its lawsuit does not challenge the ban on adult sites sharing VPN instructions either (EFF).

---

2. Why Are People Freaking Out About This Law?

Photo by Tiger Lily on Pexels

Utah’s law has sparked a lot of debate, and for good reason. Here’s why people are concerned:

The slippery slope argument

Utah didn't ban VPNs for anything. But critics worry about the direction: if a state can make websites police VPN users for one kind of content, it could try the same for others. Wisconsin lawmakers considered a similar VPN provision and dropped it after advocates raised constitutional and technical concerns (EFF).

For example, imagine if your state decided that using a VPN to watch Netflix in another country was illegal. That might sound far-fetched, but it’s not impossible. Laws like this one set a precedent, and once the door is open, it’s hard to close.

Privacy vs. safety: A tough balance

The law’s supporters argue that it’s a necessary step to protect kids online. And they’re not wrong—keeping adult content away from minors is a valid concern. But the way this law does it comes with a big trade-off: adults lose their anonymity.

Handing over your ID to every adult site you visit is like giving your driver’s license to every store you walk into. It’s not just inconvenient—it’s a privacy nightmare. What if the site gets hacked? What if they sell your data? These are real risks.

The VPN industry’s reaction

VPN companies argued from the start that the law couldn't work as written. NordVPN, for one, argued that telling VPN traffic apart from ordinary traffic is a problem the industry has not solved at scale (Gizmodo). The EFF called blocking VPN addresses "technical whack-a-mole" and said the ban on sharing VPN information raises First Amendment concerns, because it stops sites from giving basic, truthful information about a lawful privacy tool (EFF).

The court's ruling turned on the same practical problem: both sides agreed that no website can know every visitor's location with certainty (court decision).

---

3. How to Stay Private Online in Utah (Without Breaking the Law)

If you’re in Utah (or just want to stay private online), here are some legal ways to protect your privacy without running into trouble:

Option 1: Use a VPN for everyday privacy

VPNs are legal in Utah, and these everyday uses are not affected by SB 73 at all (Gizmodo):

• Streaming geo-blocked content: Want to watch a show that’s only available in the UK? A VPN can help. SB 73 has nothing to do with streaming services; whether a service allows VPN viewing is a matter of its own terms, not Utah law.
• Protecting your data on public Wi-Fi: Coffee shops, airports, and hotels are hotspots for hackers. A VPN encrypts your data, making it much harder for anyone to snoop on your activity. If you’ve ever used public Wi-Fi, you’ll want to read our Public WiFi Risks Guide for more tips.
• Keeping your browsing private from your ISP: Your internet service provider (ISP) can see which sites you visit. A VPN hides your activity from them, which is especially useful if you’re researching sensitive topics.
• Working remotely: If your employer has you connect through a work VPN, keep doing it. Nothing in SB 73 changes that.
• Banking on hotel or airport Wi-Fi: Logging in to your bank on a network you don't control is safer with a VPN encrypting the connection.

Analogy: A VPN is like a PO box for your mail. It doesn’t hide who you are, but it keeps your home address private.

Option 2: Try privacy-focused browsers or search engines

If you’re not ready to commit to a VPN, you can still take steps to protect your privacy with tools like:

• DuckDuckGo: A search engine that doesn’t track your searches or sell your data. It’s a great alternative to Google if you’re researching sensitive topics.
• Brave Browser: A web browser that blocks ads and trackers by default.

Example: If you’re looking up health information or financial advice, these tools won’t store your search history or sell your data to advertisers.

Option 3: Use a password manager + private email

These tools limit the damage when a site you use gets hacked:

• Bitwarden: A password manager that stores your logins in an encrypted vault. It’s free and easy to use.
• ProtonMail: An email service that encrypts your messages, so even if someone intercepts them, they can’t read them.

Why it matters: Password managers make it easy to use strong, unique passwords for every site. That way, if one site gets hacked, your other accounts stay safe. For more tips, check out our Complete Guide to Online Privacy.

Option 4: Check your VPN's basics

Whatever VPN you use, a few quick checks make it better at protecting your privacy:

• Look for a clear no-logs policy. A provider that doesn't keep records of what you do online has nothing to hand over.
• Run a DNS leak test. A DNS leak sends your browsing requests to your internet provider instead of through the VPN, which can reveal where you are. Our free DNS Leak Test checks it for you.
• Turn on the kill switch. It cuts your internet connection if the VPN drops, so your traffic doesn't slip out unprotected.
• Keep the app updated so you have the latest security fixes.

---

4. Who Can Get in Trouble Under the Law? (And How to Avoid Trouble)

Photo by Soundarapandian MS on Pexels

No one wants to get fined or face legal trouble, so here’s what you need to know:

Penalties fall on websites, not visitors

• Websites can be sued: Under the 2023 law, an adult site that skips the age check can be sued for damages (AVPA), and SB 73 gave Utah's Division of Consumer Protection powers to enforce the rules (court decision).
• Visitors: SB 73 does not ban using a VPN (EFF), and the court described the law as putting liability on the websites.

How to stay on the right side of the law

• You must be an adult to view adult sites, with or without a VPN. If a site asks you to verify your age, its own check is the route the law expects.
• Don't help a minor get around an age check, whether with your account or your VPN.
• Pro tip: Rather than check IDs, some sites, Pornhub among them, block their adult content for visitors from Utah (KUER).

What if you’re not in Utah?

No need to panic. Utah's VPN rule is about people who are physically in Utah, and the court noted the law imposes no liability for content a site lawfully supplies to users in other states (court decision). But at least 27 states have passed age-check laws for adult sites, including Louisiana, Texas and Virginia (AVPA), so keep an eye on yours.

---

5. The Bigger Picture: Will Other States Follow Utah’s Lead?

Utah’s law didn’t happen in a vacuum. It’s part of a broader trend where states (and even the federal government) are trying to regulate the internet. Here’s what you need to know:

States to watch in 2026

• At least 27 states have passed age-check laws for adult sites, starting with Louisiana and Utah in 2023 (AVPA). To the EFF's knowledge, Utah is the first to write VPN users into one, and Wisconsin dropped a similar VPN clause after pushback (EFF).
• Federal bills, like the SCREEN Act, would go further than the age-check laws in other states. It would require age checks on nearly any site with sexually explicit content, including on traffic from known VPN addresses. A Senate committee voted 15 to 13 to advance it on August 5, 2026, but it did not move forward because too few senators attended (EFF).

What this means for your privacy

• More states may try to restrict VPNs for specific uses, like gambling, streaming, or adult content.
• Silver lining: Privacy tools (like VPNs) are getting more attention, which could lead to better protections in the long run.

How to stay informed

• Follow tech news sites like CNET or The Verge for updates.
• Check if your state has proposed similar laws. The Electronic Frontier Foundation is a great resource for tracking these issues.

---

Key Takeaways (TL;DR)

Here’s the bottom line:

• Utah didn't ban VPNs. Using one in Utah is legal.
• The rules are aimed at adult websites. They must check the age of visitors in Utah, and SB 73 says that includes visitors who use a VPN.
• That VPN rule is on hold. A federal judge blocked it on September 24, 2026 while the case continues. The 2023 age-check law still applies to the sites.
• How to stay private legally:
  • Use a VPN for streaming, work, public Wi-Fi or general privacy.
  • Try privacy-focused tools like DuckDuckGo or Brave.
  • Use a password manager (like Bitwarden) and private email (like ProtonMail).
• Stay out of trouble: You must be an adult to view adult sites, VPN or not, and don't help a minor get around an age check.
• What’s next? At least 27 states have age-check laws for adult sites, and Congress has the SCREEN Act in front of it.

---

How GhostShield VPN Can Help

If you want a VPN for the everyday privacy uses above, GhostShield encrypts your connection with WireGuard, keeps a strict no-logs policy, and includes a kill switch and DNS leak protection. It has apps for Windows, macOS, Android, iPhone and iPad, and Google TV. There is no Utah location; its US servers are in New York, Los Angeles, Palo Alto and Miami.

Every plan starts with a 7-day free trial (a card is required). If you’re ready to take control of your online privacy, you can check out GhostShield’s pricing or download it here.

Stay safe out there!