Utah age-verification law targets VPN users, raises stakes for gaming platforms

Utah has moved age verification from a back-end compliance issue into a direct access problem for anyone logging in through a VPN or proxy. Senate Bill 73, the Online Age Verification Amendments, took effect on May 6, 2026, and says a user is treated as accessing from Utah if that person is physically in the state, even when the connection is masked.

For game stores, launchers, chat tools, and account systems, that matters immediately. A player using a VPN for privacy, while traveling, or to keep a home connection stable could get caught in the same net as someone trying to bypass age gates. Utah’s law also bars covered commercial entities from facilitating or encouraging VPN use to dodge those checks, including giving instructions on how to do it, which pushes the compliance burden beyond simple age prompts and into how platforms talk about access at all.

Governor Spencer Cox signed the bill on March 19, 2026. The measure builds on Utah’s 2023 age-verification law, SB 287, but goes further by giving the Utah Division of Consumer Protection authority to investigate violations and set enforcement in motion. The law also brings administrative fines and civil penalties, and the legislative summary says it appropriates $4 million for fiscal year 2027. Utah’s enrolled bill text adds a 2% excise tax on certain entities that provide content harmful to minors, another sign that the state is tying age assurance to both enforcement and revenue.

The sweep is notable because it is not limited to porn sites in the narrow sense. Utah defines a “substantial portion” as more than one-third of a site’s total material, which means any service that crosses that threshold can find itself inside the statute’s reach. That is why the gaming angle is so sharp: platform policies, regional access rules, and identity checks already overlap in the game industry, and Utah has now made VPN use part of the legal risk calculation.

The Electronic Frontier Foundation says Utah became the first state in the nation to target VPN use to avoid legally mandated age-verification gates, and it calls the law a “liability trap.” TechSpot reports that NordVPN and other providers argue blocking every known VPN and proxy IP in Utah would be technically impossible because addresses change constantly and no complete blocklist exists. That leaves platforms with a hard choice: block broadly, verify more aggressively, or risk penalties under a law that takes effect just as age assurance becomes a sharper consumer-access issue across the internet.