Utah age verification law: VPNs Out, ID Data In

Here's a text you might send a friend at 11pm: "Wait, my VPN didn't work?" That's the exact reaction Utah wants websites to trigger right now. A VPN (a tool that makes it look like you're browsing from somewhere else) used to be the easy workaround for age gates. Utah just built a law that says: nice try.

The Utah age verification law now requires websites to check a user's age category (the label a site assigns you, like "adult" or "minor," based on age proof) even when that user is hiding behind a VPN, which means more sites may soon ask your family for ID, a face scan, or a credit card just to browse.

Let's back up. In 2023, Utah passed the country's first age verification law aimed at adult content sites. It worked exactly the way you'd expect a law with a giant loophole to work: people in Utah just turned on a VPN, told the website they were browsing from Wyoming or Nevada, and skipped the age check entirely. VPN sign-ups in the state reportedly spiked. Nobody was shocked. If you tell people "don't look over there," a lot of them look over there.

So lawmakers went back to the drawing board. The new mandate, which some outlets are calling Utah's most aggressive move yet, doesn't just ask websites to check where you say you are. It says that if you're physically sitting in Utah, the age verification law applies to you no matter what your VPN tells the website. Rep. Steve Eliason, a familiar name in Utah's push on kids' online safety bills, has been one of the lawmakers associated with this wave of legislation aimed at protecting minors online.

What Utah's Age Verification Law Actually Requires

Here's the part that should make you sit up: this age verification law requires app store providers, not just individual websites, to play a role in checking a user's age category before certain apps or content become available. That's a bigger ask than it sounds. App store providers sit above thousands of apps. If they're on the hook for verifying age, they need some system that follows you across your whole phone, not just one browser tab.

A VPN provider called this an "unresolvable compliance paradox" in comments reported by TechRadar. Think about what that means in practice. A website has no real way to know, with certainty, whether the person clicking "I'm 21" is actually sitting in a Utah living room or a Boise coffee shop. But under this law, the website can face liability either way. That's not a technical problem you fix with better code. That's a legal trap with no clean exit. This article is part of a series, start with Biometric Data Definition Why Basfs Apple Suit Isnt Privacy .

Utah's new law regulating VPNs goes into effect, and it puts service providers in the impossible position of having to determine a user's true physical location without violating their privacy.

Electronic Frontier Foundation, EFF Deeplinks

Why the utah age verification law targets VPN use specifically

The short answer: because the first version of this law didn't stop anyone. If you build an age check that a fifteen year old can beat with a free app in ten seconds, you haven't built child safety. You've built a speed bump. Utah's response was to make the law follow the person, not just the internet connection. Whether that's enforceable is a separate question, and a big one, but the intent is clear: close the door VPNs opened.

---

The Real Question Isn't VPN vs No VPN, It's Who Gets Your Data

Here's the thing nobody's saying out loud enough: this fight was never really about VPNs. It's about what happens once VPNs stop being a viable dodge. When a site can't rely on your location to guess your age, it has to verify some other way, and every other way involves handing over something personal. An ID scan. A face scan that estimates your age from your features. A credit card number, which proves you're an adult mostly because minors don't usually have one.

None of those methods are free of trade-offs. Age estimation tools guess your age from a photo, and they're probabilistic, meaning they're often right but sometimes wrong, especially at the edges (a 17-year-old who looks 22, or the reverse). If a site's estimate is wrong and a court or regulator later asks how the site made that call, "the algorithm thought so" isn't exactly a satisfying answer. That's the deeper problem sitting underneath the VPN headline: enforcement doesn't follow age. It follows identity. Once a system needs your identity to confirm your age, you've traded a browsing habit for a data trail. Previously in this series: Ai Identity Verification 8 065 Deepfakes Hit One Bank Podcas.

How the Utah Age Verification Law Compares to Other State Bills

Utah isn't operating in a vacuum here. States across the country have introduced their own bills on age verification, parental consent, and what social media companies owe to kids using their platforms. Some of these bills have already become law; others are still working through their state senate. The table below lays out where a few of these efforts stand, in plain terms.

State approach	Status	What it actually requires
Utah age verification law (VPN provision)	Enacted	Age verification applies based on physical location, even if a VPN masks it; app store providers included
Wisconsin VPN provision	Removed	Lawmakers stripped the VPN-targeting language after pushback from digital rights groups and residents
General parental consent bills (various states)	Pending or enacted, varies	Require parental consent before minors can sign up for certain apps or social media platforms

Notice that Wisconsin actually backed off the VPN piece entirely. That's a signal worth paying attention to. Even in states friendly to age verification bills, holding companies liable for a user's VPN use is politically shaky ground. It sounds tough on paper. In practice, it asks websites to solve a problem nobody has solved yet.

---

What This Means If You've Ever Wondered "Is This Really Me Being Verified?"

If you've ever paused before uploading your ID to a random site, or wondered whether that "quick face scan" really deletes your photo afterward, you're not being paranoid. That's the exact question this whole category of technology exists to answer, and honestly, most people have never gotten a straight answer. Here's one useful thing to actually watch for before you hand anything over: check whether the site's age check happens on your device (a quick estimate that never leaves your phone) or sends your ID and photo to a third party's server. That single detail tells you almost everything about your actual privacy risk in that moment. A local, on-device check is a very different animal from uploading your driver's license to a company you've never heard of.

Zoom out and this fits a bigger pattern. Social media companies and media companies of all kinds are under real pressure right now, from parents, from state legislatures, from courts. Kids online safety is popular with voters on both sides. But every bill that promises to protect kids also has to answer a quieter question: what happens to the data collected to prove someone is an adult, or isn't? Utah's law doesn't really answer that. It just moves the burden from the browser to the person.

Utah age verification and what happens to your session data

Once a site verifies your age category, it often keeps some record tied to that session (your single visit or login), sometimes longer. Utah's law doesn't fully spell out retention rules for every site it covers, which is exactly why reading a site's privacy policy before you verify, not after, actually matters here. Up next: Ai Voice Cloning Scam 1 2 Seconds Fakes A Childs Voice.

---

So here's where this actually lands. Utah didn't fix its age verification problem by making the internet safer for kids. It fixed it by making adults easier to identify. A law built to stop a fifteen year old from lying about her age is now the same law that might ask her mom for a driver's license photo just to read the news. That's not a loophole. That's the whole design, working exactly as written.

utah age verification law: Frequently Asked Questions