# Utah SB 73: what a site can and can't know about VPN users

What IP geolocation can and can't tell you about VPN users under Utah's SB 73, what a datacenter blocklist misses, and a pattern for masked visitors.

Utah's SB 73 is the first US law that makes a website answer for visitors who hide where they are. On September 24, 2026, a federal judge blocked its central VPN clause, finding that it holds a site to perfect geolocation, which doesn't exist. The rest of the law still applies, and the question at its center, what a site can know about a visitor on a VPN, is the one the UK, the EU and Australia are asking too. This post is about the engineering of that question, not legal advice.

## What SB 73 says

SB 73 amends Utah's age verification law, which covers commercial sites where more than 33-1/3% of the material is harmful to minors. Its VPN provisions took effect on May 6, 2026. Subsection (3) of 78B-3-1002 is the one that made headlines, and the one Aylo, Pornhub's parent company, sued to stop:

> An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location to make it appear that the individual is accessing a website from a location outside this state.

Subsection (4) says a covered site "may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements", including by providing "instructions on how to use a virtual private network or proxy server to access the website" or "means for individuals in this state to circumvent geofencing or blocking".

The Division of Consumer Protection can fine a site up to $2,500 per violation, and a court can impose a civil penalty of up to $2,500 per violation (section 78B-3-1004 of the [enrolled bill](https://le.utah.gov/Session/2026/bills/enrolled/SB0073.pdf)).

On September 24, Judge David Barlow of the US District Court for Utah granted Aylo a preliminary injunction against subsection (3). Read with the rest of the statute, he wrote, it "requires entities like Aylo to geolocate its website users with perfection to avoid liability. It is undisputed that geolocation perfection is not presently possible." Utah's attorney general had said the state would expect only reasonable efforts, but the statute says nothing about them. With about 28 million visitors a month from the US, Aylo would have to age-verify every one of them to be sure of the ones in Utah, and the court found the provision likely violates the dormant Commerce Clause ([the order](https://www.courthousenews.com/wp-content/uploads/2026/09/aylo-freesites-utah-division-consumer-protection-opinion.pdf), [EFF](https://www.eff.org/deeplinks/2026/10/court-agrees-eff-utahs-vpn-law-demands-technical-impossibility)). Subsection (4) and the age verification requirement itself were not enjoined.

On September 1, Utah's Division of Consumer Protection proposed a rule saying what it would count as reasonable ([R152-78B](https://rules.utah.gov/wp-content/uploads/b20260901.pdf), in the Utah State Bulletin). Its test for a site's VPN and location checks: they must be calculated to tell, with at least 95% accuracy, whether a visitor is in Utah, and they may use signals such as connection latency and the device's time zone. It came after the briefing and the hearing, so the court didn't consider it. Comments closed on October 1, and the rule may take effect as soon as October 8.

## What an IP address can tell you

IP geolocation puts most visitors in the right state, quickly and cheaply, and it's how every geofence works. It isn't perfect, which is what the ruling turned on.

What it can't do is see through a VPN or a proxy. The address a site sees then belongs to the VPN server or the proxy exit, and geolocation reports where that is. A Utah visitor on a VPN server in Denver geolocates to Denver.

What a site can know about that visitor is that the connection is masked. That's the signal that separates a Denver resident from a Utah resident on a Denver VPN server: the first has an ordinary connection and the second doesn't. It's what a VPN detection API answers.

In the Utah case, the two sides' experts disputed how reliable the commercial services that detect VPNs are, and both sides agreed that nothing detects every VPN user. But, in the court's words, "no party disputes that they can assist in detecting location-obfuscation technologies."

## Three ways to comply

1. Age-verify every visitor. It covers every case, and it puts a verification step, its cost and the retention rules in subsection (2) in front of every visitor from every state.
2. Geo-block Utah. It's the cheapest to run, and it stops the Utah visitors geolocation finds and none of the ones on a VPN, which are the ones subsection (3) names.
3. Geofence, and treat masked connections as possibly Utah. Visitors geolocated to Utah verify their age, and so does every visitor on a VPN, proxy or Tor, since they could be in Utah. That's one lookup per new visitor, and a verification step for Utah and for the share of traffic that is masked. The proposed rule's safe harbor is built on the same check: a site detects masked connections and has each of those visitors share their location to show they're outside Utah, turn the VPN off and verify their age if they're in Utah, or verify their age.

## What a datacenter blocklist misses

A common answer to this law is to block datacenter addresses. This is what that catches, from our data on September 27, 2026. Hosting space here means /24 blocks our hosting classification covers.

| | IPv4 addresses | Outside hosting space |
|---|---:|---:|
| VPN, all types | 22,899,849 | 6,365,765 (27.8%) |
| Consumer VPN services | 3,117,223 | 302,832 (9.7%) |
| Corporate VPN gateways | 1,919,549 | 1,289,136 (67.2%) |
| Peer-to-peer VPNs | 142,883 | 46,669 (32.7%) |
| VPN endpoints with no brand attached | 17,720,194 | 4,727,128 (26.7%) |
| [Residential proxies](https://vpndetection.io/databases/residential-proxy-ip), seen in the last 90 days | 69,167,157 | 51,918,008 (75.1%) |

A VPN endpoint with no brand attached is one our scans confirm but can't yet tie to a service. Two thirds of those outside hosting space share a /24 with residential proxy exits, so they sit in consumer ISP address blocks.

So a datacenter blocklist handles most consumer VPN services. What gets past it sits in ISP address space, where it looks to the blocklist and to geolocation like any other customer of that ISP.

## Routing masked visitors to age verification

Flag VPN, proxy and Tor connections, send those visitors to age verification instead of blocking them, and log the decision. Here it is as Express middleware with [`vpndetection-express`](https://docs.vpndetection.io/integrations/express):

```js
import express from 'express';
import { vpndetection } from 'vpndetection-express';
import { isUtah } from './geofence.js'; // your IP geolocation check

const app = express();
app.set('trust proxy', 'loopback'); // your reverse proxy, on this machine
app.use(vpndetection({ apiKey: process.env.VPNDETECTION_API_KEY }));

// Each of these means the address is not where the visitor is.
const MASKED = ['isVpn', 'isResproxy', 'isMobproxy', 'isDcproxy', 'isTor'];

app.use((req, res, next) => {
    const { result, error } = req.vpndetection;
    const masked = MASKED.filter((flag) => result?.[flag]);
    // A failed lookup is not an answer, so it verifies too.
    req.verifyAge = masked.length > 0 || error !== undefined || isUtah(req.ip);
    const lookupError = error?.kind ?? null;
    console.log(JSON.stringify({ masked, lookupError, verifyAge: req.verifyAge }));
    next();
});

app.get('/watch/:id', (req, res) => {
    if (req.verifyAge && !req.session?.ageVerified) {
        const back = encodeURIComponent(req.originalUrl);
        return res.redirect(`/verify-age?next=${back}`);
    }
    res.send(`video ${req.params.id}`);
});

app.listen(3000);
```

We ran it against a VPN server, a residential proxy exit on a US cable ISP, and an ordinary home address on the same ISP. The first two were redirected to `/verify-age`, the third got the video, and the log read:

```
{"masked":["isVpn"],"lookupError":null,"verifyAge":true}
{"masked":["isResproxy"],"lookupError":null,"verifyAge":true}
{"masked":[],"lookupError":null,"verifyAge":false}
```

With an invalid API key, the lookup failed and the visitor was sent to verification anyway: `{"masked":[],"lookupError":"unauthorized","verifyAge":true}`. The middleware fails open by default so an outage of ours never takes your site down; for an age gate, an unknown answer should verify.

The log line keeps the decision and drops the address, since subsection (2) bars keeping identifying information once access is granted. And a masked visitor is verified rather than blocked: an adult in Denver on a VPN can still get in.

`isVpn` comes back on every plan. The proxy and Tor flags need a plan that includes them ([pricing](https://vpndetection.io/pricing)), and a flag your plan doesn't include is `undefined`, which this code reads as not masked. Past a few million distinct visitors a day, look addresses up locally from the [VPN IP](https://vpndetection.io/databases/vpn-ip) and residential proxy databases instead of calling the [API](https://vpndetection.io/api) per request.

## What subsection (4) means for your help pages

Subsection (4) isn't enjoined. A covered site can't give instructions for reaching it through a VPN or proxy, or offer a way around its geofence. Look for the places that say it without meaning to: a help-center answer that suggests a VPN when a video won't load, a support macro that says the same, a "not available in your region" page that points at one.

## Other places moving the same way

- UK: age checks under the Online Safety Act have applied since July 2025, and the government has said services that promote VPNs to get around them could face enforcement ([Mishcon de Reya](https://www.mishcon.com/news/online-safety-act-vpns-and-age-verification-what-the-house-of-lords-debate-reveals)).
- EU: a European Parliament research briefing reports calls to treat VPNs as "a loophole in the legislation that needs closing" ([EPRS](https://www.europarl.europa.eu/RegData/etudes/ATAG/2026/782618/EPRS%5FATA%282026%29782618%5FEN.pdf)). It's a briefing for MEPs, not policy ([Euronews](https://www.euronews.com/my-europe/2026/05/15/fact-check-is-the-eu-about-to-restrict-the-use-of-vpns)).
- Australia: eSafety's codes have required age checks for adult content since March 2026, and eSafety will look at whether providers took reasonable steps to prevent workarounds like VPNs ([Tech Business News](https://www.techbusinessnews.com.au/australias-vpn-shakeup-what-esafety-detection-means-for-your-business)).
- Brazil: the ECA Digital has required reliable age verification, with self-declaration ruled out, since March 17, 2026 ([Mayer Brown](https://www.mayerbrown.com/en/insights/publications/2026/04/enforcement-of-brazils-eca-digital-introduces-new-obligations-for-companies)).

Middleware for Laravel, Django, Rails and other frameworks is in the [docs](https://docs.vpndetection.io/integrations).