Utah Just Closed the VPN Loophole. Here's What It Means If You Run Your Own Site.

Today, September 3, 2026, Utah's SB 73 took effect — and it is worth your attention even if you have never had a single fan or subscriber in Utah. Every prior state age-verification law shared the same quiet blind spot: they defined who counted as an in-state user by IP address, which meant a fan (or a regulator's test account) running a VPN could simply appear to be browsing from Wyoming instead. SB 73 closes that specific gap. It is being reported as the first U.S. law to explicitly target VPN use for this purpose, and the mechanism it uses is one other states are already watching as a template.

Most coverage of this law is being written for a general audience, which means it's being framed as a privacy story about VPNs. For you, it's a different story: it's an operations story about what "reasonable age verification" actually costs to implement, and who is on the hook when it isn't done right. That answer is very different depending on whether you're a platform with a compliance department or a solo creator running your own site.

What SB 73 actually requires

The law applies to sites where more than one-third of total content meets the legal standard for material "harmful to minors." Those sites must run what the law calls "reasonable age verification" for anyone accessing the site who is a Utah user. That threshold matters: a general-audience platform with an adult section is treated differently than a site that is substantially adult content, and it is the latter the law is aimed at. If your own site or funnel clears that one-third bar, SB 73's obligations apply to you directly, not just to the large platforms you might post on — and unlike a platform, there is no one else's legal team standing between the law and your business.

The part that's actually new: location, not IP

Here is the mechanism that makes SB 73 different from the wave of age-verification laws that came before it. Instead of defining a "Utah user" by IP address — the standard every prior law used, and the standard a VPN was built to spoof — SB 73 defines a Utah user by physical location. A fan who is physically standing in Utah is a Utah user under this law regardless of what their IP address claims, VPN or no VPN. That's a meaningfully different compliance target: it shifts the question from "what does this connection look like on the network" to "where is this person actually located," which is a harder thing to fake and a harder thing to defend having gotten wrong.

The law also closes a second door: sites subject to it are barred from publishing instructions on how to use a VPN to route around the age gate. That provision is narrow and worth being precise about — it does not ban VPN use in general, and it does not ban VPNs for any other purpose. It only prohibits an age-gated adult site from telling its own users how to defeat that specific gate. If your content or support material has ever pointed fans toward a VPN as a workaround for a regional restriction, that specific instruction is now the thing to remove for Utah users.

What it costs to get wrong

Penalties run $2,500 per violation, on top of civil liability — meaning a private right of action, not just a regulator's enforcement decision, can be part of the exposure. That combination is what makes this worth planning around rather than waiting to see what happens: a per-violation structure plus civil liability can add up fast if verification is missing or broken for a stretch of time, and it doesn't require a regulator to notice first.

Why this lands harder on a solo operation than on a platform

A law that says "run reasonable age verification" reads the same on paper whether it's aimed at a platform with a nine-figure valuation or a single creator running a $29-a-month page builder with a paid tier bolted on. In practice, it is not remotely the same lift, and the gap is worth naming plainly:

• You don't have a legal team to interpret "reasonable." The law names a standard, not a specific method or vendor. A platform's legal department gets to make that judgment call once, with counsel, and apply it across millions of users. As a solo creator, that same judgment call — which verification method actually counts as "reasonable" for your specific site — is yours to make alone, usually by reading vendor marketing copy instead of a legal brief.
• The liability is personal, not absorbed by a company. If a large platform gets a compliance decision wrong, the $2,500-per-violation exposure and any civil suit lands on a corporate entity built to absorb legal risk. If your own site is a sole proprietorship or a thinly-capitalized LLC, that same exposure lands much closer to you personally, with far less of a buffer between the business and your own finances.
• Per-check verification costs eat a much bigger share of a small funnel. A third-party age-verification vendor charging even a modest fee per check is a rounding error for a platform processing millions of visits. For a creator whose entire funnel might see a few hundred visits a month, that same per-check cost is a real, visible line item against a much smaller revenue base.
• Age gates cost conversions, and you feel that loss directly. Every extra step between a new visitor and your paid offer reduces the percentage who complete it — that's true for anyone, but a platform with enormous top-of-funnel traffic barely notices the dip. On a solo funnel where every visitor was expensively earned through your own content and marketing, the same percentage drop is a bigger absolute hit to your income.
• Record-keeping is on you too. Being able to show that verification ran, and ran correctly, if it's ever questioned is not automatic — someone has to keep that record. On a platform, that's an engineering and compliance function. On your own site, it's you, unless you've specifically confirmed your verification vendor handles it and can produce it if asked.
• You're less likely to notice the law changed at all. A platform has people whose job is to track state legislation. As a solo creator, this kind of law tends to arrive as a surprise headline rather than something flagged to you in advance — which is a big part of why it's worth building a habit of checking your own exposure rather than assuming someone else is watching it for you.

None of this means the law is unreasonable to comply with. It means the honest starting point is recognizing that "just add age verification" is a much bigger, costlier, and more personally exposed task for a solo operation than it is for a platform, and planning accordingly rather than assuming it'll sort itself out the way it might for a company with a compliance department.

What this actually means if you run your own site or funnel

• Check whether the one-third threshold applies to you. A site or page that is substantially adult content is a different case than a general profile with some adult material mixed in. If you're close to that line, treat it as applying to you rather than betting on the distinction holding up. This is worth a deliberate five-minute audit, not a guess.
• Don't rely on IP-based geofencing as your compliance answer. If your current age-gate logic (your own, or a tool's) only checks IP address or self-attested state, it was already a weak defense and SB 73 is a preview of where the standard is headed — location-based, not network-based.
• Price out a verification vendor before you need one, not during a scramble. Get the actual per-check cost, not just the headline pitch, and run it against your real traffic numbers so you know what compliance actually costs your specific business before you commit to a tool.
• Remove any VPN-workaround language aimed at your own age gate. This is a narrow, specific fix: if anything you've published tells users how to get around your own or a platform's age check using a VPN, take it down. General VPN-for-privacy content is unaffected.
• Keep your own record that verification ran. Confirm with any vendor you use whether they retain proof of a completed check and for how long, and don't assume "yes" without asking.
• If you're structured as a sole proprietorship, this is one more reason to look at an LLC. Separating your personal finances from your business's legal exposure matters more, not less, as the list of laws with per-violation penalties and civil liability grows.

Why this is likely to spread

Utah is not acting in isolation. Roughly half of U.S. states now have some form of age-verification law for adult sites on the books, with more advancing bills in 2026 sessions, and the trend since the Supreme Court's 2025 Free Speech Coalition v. Paxton ruling has been toward more states adopting these laws, not fewer. See Age Verification Laws Are Spreading Fast for that broader landscape. What makes SB 73 specifically worth flagging inside that trend is the mechanism, not the state: location-based enforcement closes a loophole that every IP-based law before it left open, and lawmakers in other states watching Utah's rollout have an obvious incentive to copy a version that doesn't have the same hole in it. If that happens, "check your IP-based geofencing" stops being a defensible compliance posture anywhere, not just in Utah — and the solo-operator cost gap described above stops being a one-state problem too.

Where this connects

This is platform and legal risk in the specific, current-events sense: a rule change you did not choose, arriving on a fixed date, that changes what compliance actually requires of a site you may control directly — and that lands harder on a business of one than on a business with a legal department. See There Are Three Kinds of Risk in This Business for how legal risk like this fits alongside platform and identity risk, Your Funnel Builder Didn't Ban You. Its Payment Processor Did. for the related reality of compliance costs stacking up beneath your own site, and Creator to CEO's Book 2 material on ownership and infrastructure for the fuller framework on building compliance into a site you own rather than reacting state by state.