Utah age verification law: VPN users now trigger ID checks

A verification company left the keys to its front door hanging online for more than a year. According to the Electronic Frontier Foundation, a firm called AU10TIX left its login credentials exposed for over twelve months. Anyone who found them could reach the sensitive data people had handed over to prove their age.

If you've ever uploaded your driver's license to

If you've ever uploaded your driver's license to get into a website, this story is about you. A new law in Utah is about to make that request far more common. Governor Spencer Cox signed Senate Bill seventy-three on 03/19/2026. It took effect this past May. Utah is now the first state in America to hold websites responsible even when visitors use a V.P.N. to hide their location. So if this law spreads, how many times will you end up handing your I.D. to a stranger on the internet?

Let's start with that V.P.N. piece, because it's the strange part. A V.P.N. is a tool that masks where you are online. Millions of people use one for privacy, nothing shady about it. Utah's law tells websites they must verify a user's age even when that person is using a V.P.N. to spoof their location. The company NordVPN calls this an unresolvable compliance paradox. In plain terms, the whole point of that tool is to hide your location, so the law asks websites to do something the technology makes impossible. Civil liberties groups say there's simply no clean way to comply.

Now, why does the V.P.N. angle matter for you? Every time a state passes one of these age-check laws, V.P.N. sign-ups spike. It happened in Florida, Texas, and Missouri. It happened in the United Kingdom and Australia too. Utah lawmakers looked at people protecting their privacy and decided the privacy tool was the problem. That tells you enforcement is heading one direction, more aggressive, and more of your data collected.

Here's the second thing worth knowing

Here's the second thing worth knowing. Some adult sites have tested face-scanning services to guess your age. One is called Yoti. It uses your webcam to read your facial features and estimate how old you are. Think about what that means. To prove you're an adult, you might hand over a scan of your face, the most personal data you own.

And that leads to the real trap. The danger isn't just one leaky company. It's that we're being trained to say yes. When a screen asks you to prove your age, you stop questioning it. The Internet Society warns that scammers already build fake pages posing as verification services. They flash the words prove your age, and your I.D. lands straight in a criminal's inbox. The law meant to protect kids ends up creating fresh targets for identity theft.

There is a real case for these laws, and it's worth saying out loud. Predators do target teenagers. Sextortion and crypto scams hit minors hard, partly because a teenager's credit history is blank, so fraud can go unnoticed for years. A state could reasonably argue age checks reduce that harm. The trouble is the execution. Right now, Utah has paused enforcement against Pornhub's parent company while a court fight plays out. No state has solved the basic problem, where all this sensitive data goes, and who keeps it safe.