Utah's New VPN Law Says Your IP Address No Longer Decides Where You Are

Utah's SB 73 became enforceable on September 3, 2026, when the non-enforcement agreement that had held it since May lapsed, and the state promptly agreed not to enforce it anyway. The Utah Division of Consumer Protection and Aylo, the company behind Pornhub, filed a joint stipulation extending a period of forbearance to September 17, or until the division's rule takes effect or U.S. District Judge David Barlow rules on Aylo's motion for a preliminary injunction, whichever comes first. Barlow heard argument on July 30 and told the parties he could not commit to a date.

The clause everyone is watching is one sentence long. Section 78B-3-1002(3) of the Utah Code, as amended by SB 73, reads:

An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location to make it appear that the individual is accessing a website from a location outside this state.

Read that as a network engineer rather than as a lawyer. Geo-gating has worked for twenty years on a polite fiction: the IP address is the jurisdiction. Utah has now written into statute that it is not. Physical presence is the legal fact, the IP address is demoted to evidence, and the statute announces in advance that the evidence can be wrong.

What SB 73 actually requires

The duty attaches to a commercial entity whose website carries a "substantial portion" of material harmful to minors, defined in 78B-3-1001(12) as more than 33-1/3 percent of total material. Below that threshold, none of this applies to you. Above it, two obligations matter. You have to run reasonable age verification, and under 78B-3-1002(4) you may not "facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements," including by providing "instructions on how to use a virtual private network or proxy server to access the website." The EFF has called that second half a First Amendment problem, since it stops a platform from telling its users true things about a lawful privacy tool. Enforcement runs on administrative fines of up to $2,500 per violation, civil penalties of up to $2,500 per violation in court, and $5,000 for each violation of an order.

One asymmetry in the drafting should worry anyone who has to build this. Section 78B-3-1006 grants a safe harbor on age: use a verification method that meets the division's rules and you are deemed compliant. There is no equivalent safe harbor for location. The statute says the answer must be right and leaves the method entirely to you.

To be fair to the drafters, most Utah traffic is not hiding behind anything, and the clause mostly forecloses a defense rather than mandating a new capability. You can no longer point at a Nevada IP and call the question settled. Foreclosing that defense is only useful if something replaces it, though, and this is where the engineering runs out ahead of the statute.

The IP address was never a location

An IP address identifies an interface on a routing system. Everything a geolocation database says about it is inference, assembled from RIR delegation records, BGP announcements, geofeeds published under RFC 8805, and active measurement. Country is the easy part, because routing and registry data pin it down and almost nothing crosses a border silently. City is a guess with an error bar.

State is the awkward middle, and it is exactly the granularity SB 73 needs. Comcast (AS7922) and Lumen (AS209) serve subscribers across many states out of shared aggregation points, and unless the operator publishes a geofeed carving the address space up by region, a database is inferring subdivision boundaries from thinner evidence than it uses for country. Even a perfect answer would only tell you where the last hop before the public internet sits.

Four tiers of anonymizer detection, and what each is worth

The signals you can pull off an inbound address are real, and they answer two questions that get conflated constantly. Does this address describe the user? If not, where is the user instead?

The first tier is the hosting ASN. If connection.type comes back hosting, the address lives in a rack. M247 (AS9009), Datacamp (AS60068), Hetzner (AS24940), DigitalOcean (AS14061) and AWS (AS16509) carry a large share of commercial VPN exits, and nobody's living room is inside any of them. The second tier is a positive VPN identification: many providers publish their server lists outright, and the rest are observable because a single address serves thousands of concurrent users. Both tiers are strong evidence that the address is not the user, and neither carries a single bit about where the user actually is.

The third tier is the interesting one. Consumer privacy relays, Apple's iCloud Private Relay above all, hide the client address behind a two-hop architecture, but Apple publishes the egress ranges as a CSV of prefix, country code, region and city, and the relay deliberately keeps the user inside their own country and, by default, near their own city. A Provo iPhone on Private Relay still resolves to Utah:

{
  "location": {
    "country": { "code": "US" },
    "region":  { "code": "US-UT", "name": "Utah" }
  },
  "connection": { "type": "hosting" },
  "security": {
    "is_relay": true,
    "is_vpn":   false,
    "is_proxy": false
  }
}

This is the one anonymizer tier that carries usable location data, and it is the one platforms block by accident most often, because the egress sits on a hosting ASN and a coarse "is it a datacenter" rule sweeps it up with everything else. We keep relay ranges in their own dataset rather than folding them into the VPN list for exactly this reason.

Residential proxies run the exploit in the other direction

The fourth tier is where the model gives up. On July 2, 2026 the FBI seized NetNut, a residential proxy platform supplied by Popa, a botnet of at least two million compromised consumer devices. Google's Threat Intelligence Group counted 316 distinct threat clusters using suspected NetNut exits in a single week of June 2026. That is one platform, taken down, and the demand behind it does not evaporate: NetNut had itself absorbed much of the traffic displaced by the IPIDEA seizure earlier in 2026.

Under old-style country gating, the threat was somebody outside a market pretending to be inside it. Under a deemed-location rule the threat runs the other way, and the tools are the same. A resident of Provo who buys an exit in a household in Henderson, Nevada gets an address allocated to a consumer ISP, geolocating to a real residential neighborhood, with no hosting ASN, no VPN flag, and the traffic profile of one home. Exit nodes that have been observed do get flagged, which is what a proxy dataset is for, but enrollment churns constantly and a freshly recruited device is clean until somebody catches it. Until then the record is not merely uninformative. It is a confident and well-sourced wrong answer.

The limit is worth stating flatly. VPN and proxy detection answers whether an address describes the user. It never answers where the user is instead. A clean result does not put anybody in Utah, and a flagged result does not take them out of it.

A compliance posture built from probabilistic parts

The usable version of this has three outcomes rather than two. Region resolves to US-UT on an ordinary consumer connection: in scope. Region resolves elsewhere on an ordinary consumer connection: out of scope. A relay hit belongs with those two rather than with the third, since the operator publishes the region itself, and routing it anywhere else throws away the distinction the separate dataset exists to preserve. Everything else, a VPN or proxy flag or a bare hosting ASN with nothing else attached, is undetermined, which is not the same as "blocked" and should not be wired to the same code path.

The cheapest way to close the undetermined bucket is to run the age check anyway. It costs a step-up for a user who was probably never in Utah, which beats both a wrongful block and a citation. Where a session carries evidence that does not ride on the IP, use it: the billing state on a payment instrument, the account's own history, a prior verification. Then log the inputs to each decision, because the division issues citations under Section 13-2-6 with 20 calendar days to request review, and the record of why you classified a session is the record you will be arguing from.

That last point collides with 78B-3-1002(2), which bars whoever performs the age verification from retaining any identifying information about the individual once access has been granted. You need an audit trail about the decision without keeping a dossier on the person who triggered it. Nobody has a clean pattern for that yet, and the division's rulemaking is where it will get settled.

What blocking on suspicion costs

Blocking every address that smells like a VPN is the failure mode this law invites, and the collateral damage is ordinary people. Corporate egress breaks in both directions: an employee in Salt Lake City on the company VPN pops out in Virginia, while a contractor in Sacramento on a Utah employer's VPN appears in Utah and gets a regime that does not apply to them. Private Relay users are ordinary consumers, and Apple already hands you their region. Mobile is worse than any of these, because carrier-grade NAT and centralized egress put a whole region behind a handful of addresses: the "Lost in the Prefix" measurements published in 2026 put the median mobile geolocation error across four major databases at 179 to 207 km, against 3 to 16 km on fixed broadband. Salt Lake City is about 180 km from the Nevada line and 140 km from Idaho's. On a mobile connection in Utah, the median error is a state boundary.

Aylo's own answer has been to leave, and it left in 2023, over Utah's earlier age verification law rather than this one. The stipulation with the division is explicitly "contingent upon Aylo maintaining its geofencing restrictions within Utah," which means the largest operator in the category is complying by not serving the state at all. The deemed-location clause is therefore aimed at everyone who stays, in Utah and in the at least 26 other states with age verification laws in effect or under active consideration. The UK went through the same argument last year and landed on detection rather than a ban, with Ofcom due to publish guidance on circumvention by the end of October 2026. Barlow may strike Utah's clause, narrow it, or let it stand. Whatever he writes will not change what an IP address is.

Ipregistry publishes the signals that decision runs on: country and ISO 3166-2 region, connection type and ASN, and separate VPN, proxy, Tor and relay flags, so a Private Relay user is never scored like a residential proxy exit. Measuring how much of your own traffic lands in the undetermined bucket takes an afternoon and 20,000 free lookups to get started.