Utah is the first state in the nation to attempt to ban the use of VPNs — virtual private networks — to get around the state’s age verification law to view online pornography, a move that critics say is unworkable and invasive.

One provider of adult content has already sued over the requirement, arguing it requires the company to do age verification for customers everywhere in the world. The state, in response to the lawsuit, agreed not to enforce the provision until September, while the litigation runs its course.

The Legislature, in 2023, enacted a law requiring adult websites to verify the ages of all Utah users in an effort to keep pornography away from minors. But some relied on VPNs, which can provide a user with a new IP address that masks the user’s physical location, as a way around the requirement.

The new law, SB73, which was supposed to take effect Wednesday, attempts to clamp down on VPN use by tying the age verification to the user’s actual geographic location and requires porn sites to screen out Utahns who are using VPNs.

“I think Utah is really setting the precedent here for other states and other countries,” said Rindala Alajaji, the associate director of state affairs at the Electronic Frontier Foundation, a group that focuses on online speech issues.

“It’s very hard to do and a very unworkable concept, even though folks don’t want people to bypass laws they’ve passed,” she said. “I think a lot of people are eager to see how the enforcement goes.”

Critics, like Alajaji, say Utah’s ban is unworkable because it puts the onus on the company to block the constantly changing VPN and proxy server addresses, making it almost impossible to comply with the Utah mandate.

Aylo Freesites, the parent company of PornHub and other adult sites, sued the state in federal court before the VPN provision of SB73 took effect.

Attorneys for the company argue that, because VPNs are expressly designed to provide privacy and security to users, there is no reliable way for the company to verify if someone using a VPN is in Utah or elsewhere. That leaves the company with two choices: Face civil fines if someone from Utah accesses the site through a VPN, or “implement Utah’s age-verification requirements for every user of its adult content platforms, worldwide.”

The U.S. Constitution prohibits states from regulating commercial transactions between parties that have no connection to the state.

Last week, attorneys for the state agreed not to enforce the VPN law until Sept. 3, 2026, so the judge has time to consider the case.

Aylo said it has blocked access to its free sites after Utah implemented its age-verification requirement in 2023.

Last September, Aylo agreed to pay the state $5 million and potentially up to $15 million to settle an action by the state accusing the company of hosting videos and images that depict child sex abuse material and nonconsensual sex acts.

Fight for the Future, a group that opposes onerous restrictions on the internet, said it supports anyone who would sue to overturn SB73.

“You cannot require a website doing age verification to determine where someone using a reputable VPN is browsing from — this feat is literally impossible by design for even the best hacker,” said Lia Holland, the group’s director of campaigns and communications, said in a statement.

VPNs, Holland said, are “an essential tool for online privacy, security and liberty that everyone from abuse survivors to small businesses use to keep themselves safe.”

Companies that let a Utah user’s VPN slip through could face legal action by the state, which could prompt the companies to begin verifying the age of every user who tries to access the site.

“Protecting kids while preserving freedom is not a new concept,” said SB73 sponsor Sen. Calvin Musselman, R-West Haven, adding the new law uses the same principles already in place for alcohol, tobacco and gambling.

Websites will have users complete an age verification process or confirm where they are accessing the site, while still preserving the encryption options, the senator said. “This approach is intended to balance minors’ access to age-inappropriate content while maintaining user privacy and individual freedoms.”

During a hearing on the bill, Utah Division of Consumer Protection Director Katie Hass pointed to gambling sites as an example of operations that have managed to weed out the use of certain VPNs.

“We see in states like Nevada and other places where there’s gaming, companies are really getting technology savvy to get around the VPN concern,” she said. “It’s a question of whether they’re willing to do it, not whether they can do it.”

The attempt to regulate the use of VPNs was a small part of SB73, which also imposes a 2% tax on transactions by companies that provide material considered harmful to minors. Proceeds from the new tax will be dedicated to youth mental health and online safety programs.

Implementation of the tax regimen is expected to cost about $4.7 million before it starts generating revenue in the 2028 budget year.

Since the passing of the original age verification law, a spokesperson for the Division of Consumer Protection said Tuesday, porn websites “have had an affirmative duty to implement age verification measures to prevent Utah children from accessing such material on their platforms.”

They added, “These distributors continue to have a responsibility to prevent Utah children from accessing this harmful content, including safeguarding against known workarounds.”

Note to readers, 1:40 p.m.: The story has been updated to include the lawsuit against the state and the state’s agreement to not enforce the new law until Sept. 3.