• Utah began enforcing the age verification requirement in its SB 73 law for adult websites on November 2.
• A federal injunction still blocks the provision that would have made sites liable for Utah users who hide their location with a VPN.

Utah has started enforcing age checks on adult websites, but the most controversial part of its law, the one aimed squarely at VPN users, remains frozen by a federal court.

The state's Department of Commerce confirmed that enforcement of Senate Bill 73, the Online Age Verification Amendments, began statewide on Monday, November 2. Officials say the injunction only covers a narrow subsection, and that the core duty for sites to confirm visitors are 18 or older is fully enforceable.

The state has also pushed back on what it calls misleading claims that the VPN ruling paused SB 73 as a whole.

For now, people in Utah who use the best VPN for their privacy aren't in the law's crosshairs. But anyone visiting a compliant adult site from a Utah IP address should expect to prove their age.

What Utah is enforcing, and what it isn't

SB 73 requires commercial websites that host a substantial portion of material deemed harmful to minors to use "reasonable" age verification methods.

The state's Division of Consumer Protection can issue fines of up to $2,500 per violation, and the law also added a 2% excise tax on covered sites, which has applied since October 1.

To police compliance, the department says it is using specialized computing and auditing tools built by enterprise technology partners, though it hasn't explained how they work.

State Senator Calvin Musselman, who sponsored the bill, called enforcement "a necessary step to ensure that Utah's youth are shielded from explicit material."

What Utah can't enforce is Utah Code 78B-3-1002(3). This provision treated anyone physically in Utah as a Utah user, even if they masked their IP address with a VPN or proxy.

Adult site owner Aylo sued over it in April 2026. In September, U.S. District Judge David Barlow granted a preliminary injunction, finding the rule essentially made sites strictly liable for locating every user, something they can't do with certainty.

He also found Aylo was likely to succeed in arguing the rule placed an excessive burden on interstate commerce.

The VPN industry had seen this coming. NordVPN previously told TechRadar that blocking every VPN and proxy IP in Utah was "technically impossible."

What this means for people in Utah

For most residents, the change is simple: adult sites that still serve Utah should now ask you to prove your age.

That will likely mean an ID check or face scan through a third-party provider. Digital rights groups like the EFF have warned this pushes ordinary people to hand sensitive data to brokers and verification firms.

Some of the biggest sites won't change at all. Aylo has blocked Utah users since 2023, so its sites remain unavailable in the state regardless.