VPNInfobaseOnly one US state has a law on the books that writes VPNs into an age-verification statute: Utah, through S.B. 73. Its enrolled text treats a person physically in Utah as accessing from Utah “regardless of whether the individual is using a virtual private network”, and bars adult sites from giving VPN instructions. It took effect on 6 May 2026, but enforcement against the main plaintiff was paused, and press reports say a federal judge blocked the location provision on 24 September 2026. Wisconsin dropped a VPN-blocking clause and, per press and a tracker quoting the legislature’s history, its bill was vetoed; Michigan’s bill is reported as still in committee. Last checked 2 October 2026. Not legal advice.
The tracker
| State and bill | What it says about VPNs | Status as last checked | Dates, with source | Penalties |
|---|---|---|---|---|
| Utah, S.B. 73 (Online Age Verification Amendments), amends Utah Code 78B-3-1002 | Subsection (3): a person “actually located in the state” is treated as accessing from Utah “regardless of whether” they use a VPN or proxy. Subsection (4): a site with a substantial portion of material harmful to minors “may not facilitate or encourage” VPN use, “including by providing instructions” | Law in force. Aylo Freesites and Aylo Group sued the Utah Division of Consumer Protection in federal court on 22 April 2026 (2:26-cv-00340, D. Utah); the complaint challenges only the deemed-location provision, subsection (3). A preliminary injunction was reported on 24 September 2026; see the scope note below | Effective 6 May 2026 (enrolled bill, section 22; excise-tax sections 1 Oct 2026). Passed Senate 23 Feb 2026 (22-2-5) and House 4 Mar 2026 (66-1-8); signed by the Governor 19 March 2026 (legislature’s status record). Enforcement: EFF update of 11 May 2026 says Utah agreed not to enforce until 3 Sept 2026; its update of 17 Sept 2026 says Utah and Aylo agreed no enforcement against Aylo pending a ruling or final administrative rules. Press reports put the injunction at 24 Sept 2026 | Administrative fine up to $2,500 a violation; civil penalty up to $2,500 a violation; up to $5,000 for violating an order (78B-3-1004) |
| Wisconsin, A.B. 105 (age verification, 2025 session) | The introduced bill had a clause requiring sites to prevent access from IP addresses linked to a VPN. Senate Amendment 2 deleted it and added VPN providers to the entities the bill does not apply to when they did not create the content | Not law. The Free Speech Coalition tracker lists “Vetoed by the Governor” on 3 April 2026, and 404 Media quotes the Governor’s veto “in its entirety” for “intrusion into the personal privacy of Wisconsin residents” (it dates the story 6 April). Reclaim The Net says the bill “died” on 23 March 2026, which contradicts both. We could not read the veto message or the bill history at docs.legis.wisconsin.gov to settle it | Assembly passed it 69 to 22 in March 2025 (press). VPN clause removed in February 2026 (Free Speech Coalition gives 18 Feb; EFF reported the removal on 25 Feb; the legislature’s history page did not open for us) | None now; the VPN clause is gone |
| Michigan, H.B. 4938 (“Anticorruption of Public Morals Act”, 2025) | As reported by Reclaim The Net, names “VPNs, proxy servers, encrypted tunnels” as circumvention tools and would have internet service providers detect and block them. The bill text itself returned 403 to our reader | Introduced 11 Sept 2025 and referred to the House Judiciary committee (press); Reclaim The Net says no hearing is scheduled. Confirm on the legislature page | Introduced 11 Sept 2025 | Fine amounts differ between press reports and could not be checked against the bill; not stated here |
What the Utah bill covers, from its enrolled text
- Who. A commercial entity that “knowingly and intentionally” publishes material harmful to minors on a website with a “substantial portion” of it (more than 33-1/3% of the site’s material, with a rebuttable presumption if the site is branded or named as primarily providing it). The age check must be a “reasonable” method.
- VPN provisions. Two sentences in 78B-3-1002: the deemed-location rule in (3) and the ban on promoting VPNs or instructions in (4). Nothing in the bill places a duty on VPN providers or makes it an offence for an individual to use a VPN; the duties are on the site.
- Money. The bill creates a 2% excise tax on covered entities (sections 59-35, effective 1 October 2026) and two restricted accounts; the Division of Consumer Protection enforces and sets rules on age-check methods.
Where sources disagree
| Question | What each source says |
|---|---|
| When did the law start? | The enrolled bill: 6 May 2026 (section 22). EFF’s title says the same |
| When did enforcement start? | EFF, 11 May 2026: not before 3 Sept 2026 by agreement. EFF, 17 Sept 2026: not against Aylo until a ruling or final rules |
| What did the judge block on 24 Sept 2026? | The complaint (read) challenges only 78B-3-1002(3). Gizmodo reports the injunction blocks “a new provision of Utah’s age-verification law aimed at people who use VPNs to hide their location” and that the broader age-verification law stays in effect. KPCW reports an injunction against the requirement to verify users “even if they are using a VPN” and separately describes the instruction ban and 2% tax as part of the 2026 update without saying whether the order covers them. Neither outlet we read says whether it binds Utah only as to Aylo. We could not open the order, so the scope is unconfirmed |
| What happened to Wisconsin AB 105? | Free Speech Coalition and 404 Media: vetoed (3 April per the tracker). Reclaim The Net: died with the session. Official record unreadable to us; we follow the two that agree and flag it |
Why this matters to a VPN user
For someone in Utah or elsewhere, the practical effect is on the website, not on the VPN: a covered adult site might block VPN traffic or ask everyone for an age check. VPN providers’ public replies are worth reading on their own sites; we have not tested any provider’s behaviour against these laws. For the UK position, see the Online Safety Act and VPNs, and for how a provider’s own home jurisdiction works, VPN jurisdiction explained. Basics are in what is a VPN.
Not covered
Other US states have adult-site age-verification laws without VPN language, and we did not list them here. Federal bills that mention VPNs were not read at their primary text. A state with no row is not confirmed to have no VPN provision; it means we found none in the sources above.
Method
Utah: the enrolled bill PDF on le.utah.gov, read 2 October 2026. The signature date and votes come from the legislature’s own status record; enforcement dates come from EFF. The federal court order was not opened (the complaint and press reports only). Wisconsin and Michigan legislature sites refused our reader, so those rows use press and trackers and must be confirmed there. Bills change quickly; this page is reviewed every 30 days and each row carries the date it was last checked, 2 October 2026. This is not legal advice. NordVPN is the one provider we earn commission on (disclosure).