Utah becomes first state to block VPNs for age verification

Utah mandates VPN blocks for unverified web access

Utah has become the first U.S. state to require websites to block visitors using virtual private networks (VPNs) unless they can prove they are at least 18 years old. The rule takes effect on December 1, 2026, and applies to all websites accessible to Utah residents.

A VPN is a tool that hides a user's real location and makes them appear to be browsing from somewhere else. Under the new law, websites must identify when a user is on a VPN and deny access unless age verification is completed.

Core details of the new mandate

• Effective date: December 1, 2026.
• Scope: All websites reachable by Utah residents.
• Requirement: Sites must detect VPN usage and block traffic unless the visitor passes an age check confirming they are 18 or older.
• Penalties: Fines start at $1,000 for the first violation, $5,000 for the second, and $10,000 per day for any continued violations.

Legal challenges already underway

The law has faced immediate opposition. A coalition of civil liberties groups, including the ACLU of Utah, filed a lawsuit in late August 2026, arguing that the rule violates the First Amendment right to anonymous speech online.

On September 2, 2026, a federal judge blocked enforcement of the VPN provisions until after the lawsuit is resolved. This means the ban cannot be enforced while the courts review the case.

Why this matters for the internet

This is the first time a government has tried to force websites to block VPN users specifically for age checks. Experts say it could set a major precedent for how privacy tools are treated legally in the United States.

If the rule is allowed to stand, it may make VPNs less useful for everyday tasks like accessing region-specific content or protecting personal data. It also raises questions about whether other states might adopt similar laws.

What still needs to be decided

It is not yet clear whether the age verification requirements will also be blocked by the courts alongside the VPN ban. Additionally, the practical side of the law remains untested, including how websites will verify ages and how the state plans to monitor compliance.

Next steps

The lawsuit will move forward through the court system. Any final decision could determine whether Utah’s rule becomes permanent or is struck down entirely.

• Decrypt