Utah’s VPN Law Blocked: Can a Website Tell Where You Are?

Key Takeaway:
Utah’s SB 73 is the first US law that tells websites a VPN is no excuse: if a visitor is physically in Utah, an adult site has to treat them as a Utah user and verify their age, even when their IP address says they’re somewhere else. It doesn’t ban VPNs, and the penalties fall on websites, not on people using them. The law took effect on 3 September 2026, and on 24 September a federal judge blocked that VPN rule while the court case continues — because, in his words, “perfect geolocation is not possible”. The rest of Utah’s age-verification law still applies. The question at the centre of it all — can a website actually tell where you are behind a VPN? — has an honest answer: it can often tell you’re using a VPN, but it can’t reliably prove where you’re sitting.

What Utah’s VPN Law Actually Says

Senate Bill 73, the “Online Age Verification Amendments”, was signed by Governor Spencer Cox on 19 March 2026. It builds on the age-verification rules Utah already had for adult websites and adds the part that made headlines: location is decided by where the person physically is, not by what their connection looks like.

Who it covers: commercial websites where a substantial portion of the content — reported as more than one third — is “material harmful to minors”. In practice, adult sites. Ordinary websites, streaming services and VPN providers are not the target.
The VPN rule: a person counts as accessing the site from Utah if they are physically in Utah, whether or not they use a VPN, a proxy or anything else that disguises their location.
The instructions ban: covered sites may not tell visitors how to use a VPN to get around the age check.
Penalties: fines on the website, reported at $2,500 per violation. Utah’s Division of Consumer Protection handles enforcement.
A tax: the same bill adds an excise tax on these sites, with the money going to mental-health programmes and to enforcing age verification.

What the law does not do is just as important. It doesn’t make using a VPN illegal in Utah, it doesn’t fine people for using one, and it doesn’t order VPN companies to do anything. The legal risk sits entirely with the website — which is exactly why critics say it’s unworkable: the site is held responsible for knowing something it has no reliable way to find out.

📅 Where the Law Stands Now

Date (2026)	What happened
19 March	Governor Cox signs SB 73.
6 May	Original start date. Aylo, the company behind Pornhub, challenges the law in federal court, and Utah agrees not to enforce the VPN rules until September.
3 September	The law takes effect — the first US state law aimed at VPN use in age verification.
Days later	Utah’s Department of Commerce and Aylo file an agreement: the state won’t enforce the law against Aylo while US District Judge David Barlow decides Aylo’s request for a preliminary injunction. Aylo keeps blocking Utah IP addresses in the meantime.
24 September	Judge Barlow grants a preliminary injunction blocking the “actual-location” clause — the rule that a VPN user physically in Utah counts as a Utah user. He finds Aylo likely to win its argument that the clause unconstitutionally burdens commerce outside Utah, because it demands location accuracy no website can achieve.

The reasoning matters more than the result. The clause had no “reasonable efforts” escape: a site would be liable for every Utah visitor it failed to spot, however well hidden. Since no website can locate every visitor with certainty, the only safe way to comply would be to age-check everyone, everywhere — and that, the judge found, pushes Utah’s rule onto people in other states.

Three things haven’t changed. This is a preliminary injunction, which pauses the clause while the lawsuit continues rather than striking it down for good. Utah’s underlying age-verification law for adult sites still applies. And the ban on sites telling visitors how to get around age checks with a VPN wasn’t part of this ruling. The Department of Commerce had also proposed enforcement rules that could have taken effect as soon as 8 October; with the clause blocked, they can’t be enforced for now. If you’re reading this later, check whether Utah has appealed.

🔍 Can a Website Tell Where You Are Behind a VPN?

This is the part the law leaves to websites, so it’s worth being precise. A website never sees “where you are”. It sees a handful of signals, and each one is either easy to disguise, easy to get wrong, or something you have to hand over yourself.

Signal	What the site learns	Does it prove you’re in Utah?
IP address	A guessed location from a geolocation database. Behind a VPN, that’s the server’s location.	No. It’s often wrong even without a VPN — mobile networks can place you in another city or state.
Who owns the IP	Whether the address belongs to a home broadband provider or to a data centre or VPN company.	No. It can suggest “this is probably a VPN”, but not where the person behind it is.
DNS and WebRTC leaks	If the VPN is misconfigured, the real IP address or ISP can show up alongside the VPN’s.	Sometimes it points to the real network — but only when the VPN is leaking.
Time zone and language	Your device’s clock settings and preferred language, readable by any page’s JavaScript.	No. Mountain Time also covers Colorado, Idaho, Montana, New Mexico, Wyoming and more.
Browser location (GPS / Wi-Fi)	Precise coordinates — but only if you click “Allow” on the browser’s permission prompt.	Close to it, but it’s opt-in. A site can ask; it can’t take.
Payment and ID details	A billing address, or the address on an uploaded ID.	No. It shows where a card or licence is registered, not where you are today.

This is the same conclusion the court reached when it blocked the law. Put together, a website can often make a good guess that a visitor is on a VPN. Commercial VPNs run from data-centre address ranges, and lists of those ranges are sold to sites that want to flag them — it’s how streaming services spot VPNs. What no combination of these signals does is prove physical location. A person in Salt Lake City and a person in Denver using the same VPN server, the same browser and the same time zone look identical from the other end.

Detection isn’t reliable in the other direction either. VPN providers add new addresses constantly, residential proxies route traffic through ordinary home connections that don’t look like a VPN at all, and the lists that flag data-centre ranges also catch people on corporate networks and cloud services who have nothing to hide. The EFF described keeping up as “technical whack-a-mole”.

What Sites Can Actually Do About It

Because a site can’t prove where a VPN user is, the realistic ways to avoid liability are blunt:

Block Utah outright by IP address — what Aylo already does. It only stops people whose connection looks like Utah.
Block or challenge every visitor on a known VPN or data-centre address, wherever they are. That catches travellers, remote workers and privacy-conscious users in every other state.
Demand age verification from everyone, everywhere — turning one state’s rule into a national ID check, with the privacy risks of collecting and storing that data.

This is the core of the criticism from digital-rights groups and the VPN industry: a law aimed at one state ends up pushing sites toward rules that affect people who were never in Utah, while anyone determined to get around it still can.

What It Means If You Use a VPN

For most people, very little changes today. Using a VPN is legal in Utah, and the law has nothing to do with using one for work, banking, public Wi-Fi or streaming. If you’re a Utah resident on a VPN, the practical effects are on the sites covered by the law — and, over time, possibly more CAPTCHAs or blocked pages on sites that decide it’s safer to turn away VPN traffic in general.

The bigger long-term issue is identity checks. Every age-verification rule means more people uploading ID documents or face scans to more companies, and that data is only as safe as the company holding it.

It’s also a good reminder that a VPN hides less than many people assume. If you want to see what a website can read about your connection right now, you can check it yourself:

What Is My IP — the IP address, location guess and network owner a site sees.
VPN Leak Test — checks whether your real IP address shows through WebRTC or IPv6 while your VPN is on.
What We Know — the time zone, language, screen and other details your browser hands to every page.
Privacy Exposure Score — a quick overall read of how much you’re giving away.

🗺️ Is Anyone Else Doing This?

Many US states now require age verification on adult sites, but as of mid-September 2026 Utah is the only one whose law explicitly reaches VPN users. Two others show which way the debate could go:

Wisconsin dropped the VPN provision from its age-verification bill in February 2026 after public pushback, and Governor Tony Evers then vetoed the bill in April over privacy and biometric concerns.
Michigan has a proposal that would put the burden on internet providers and treat encrypted tunnels, VPNs included, as a way of getting around the rules. It has been introduced but hasn’t advanced.

Outside the US, the UK and Australia have introduced age checks of their own, and the EU is working on a shared age-verification approach. None of these is a VPN ban, but each one raises the same question Utah did: what happens when people simply connect from somewhere else?

FAQ

Is it illegal to use a VPN in Utah?

No. SB 73 doesn’t ban VPNs or penalise people for using them. It places obligations on adult websites, which can be fined if they fail to verify the age of someone physically in Utah.

Can a website see that I’m using a VPN?

Often, yes. Most commercial VPN servers use data-centre IP addresses, and sites can check an address against lists of known VPN and hosting ranges. It isn’t certain — new addresses and residential proxies slip through — but “probably a VPN” is a common and easy guess.

Can a website see my real location through a VPN?

Not from the VPN connection itself if it’s working properly. Your real IP address can show through a DNS or WebRTC leak, your time zone narrows things to a region, and precise location is only shared if you allow the browser’s location prompt. The VPN Leak Test shows whether your real network is visible.

Is the Utah VPN law being enforced?

Not the VPN part. The law took effect on 3 September 2026, but on 24 September a federal judge blocked the clause that treats VPN users physically in Utah as Utah users, while Aylo’s lawsuit continues. The rest of Utah’s age-verification law for adult sites still applies, and the state could appeal.

Does the law apply if I just drive through Utah?

On paper the law is based on physical location, so anyone in Utah would count. That is exactly the clause the court has now blocked, and for the reason critics gave all along: a website has no reliable way to know who is in the state at any given moment.

The Short Version

Utah tried to make websites, not VPN users, responsible for knowing where people really are. A federal judge has blocked that rule for now, on the ground that no website can locate its visitors perfectly — and technically, he’s right: a site can often tell you’re on a VPN, but it can’t prove where you are unless you tell it.