Utah VPN Age Law Breaks Your Geoblocking

TL;DR. Utah SB 73, the Online Age Verification Amendments, took effect on 6 May 2026, and its central sentence at Utah Code section 78B-3-1002(3) says an individual "is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location ..." That turns geoblocking from a defence into a gesture, because the question is no longer what the IP says but where the human is. The state agreed in April not to enforce the challenged provisions until 3 September 2026, and after the injunction hearing on 30 July 2026 both sides agreed to keep the law on hold until the judge rules, with no timeline given. This is general information for OnlyFans agency owners, not legal advice.

Most owners will file this as a Pornhub problem. Two consequences land on you either way: the ban on telling a fan to route around a block, which reaches captions and support replies, and the ratio test applied to any site you or a creator owns.

What a Deemed Location Rule Actually Says

SB 73 was sponsored by Senator Cal Musselman and signed by Governor Spencer Cox on 19 March 2026. It amends Utah Code sections 78B-3-1001 through 78B-3-1003, enacts sections 78B-3-1004 through 78B-3-1008, and enacts a new tax chapter, Title 59 Chapter 35, the Covered Entity Excise Tax. Most of it took effect on 6 May 2026, the tax sections on 1 October 2026.

Start with who is covered. Section 78B-3-1002(1)(a) reaches a commercial entity that "knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion" of it, and section 78B-3-1001(12) defines substantial portion as "more than 33-1/3% of total material on a website." The trigger is a ratio on one website, not a company's overall business.

Then read the presumption, which is what catches funnel operators. Section 78B-3-1002(1)(b) presumes a site is over the line where it markets itself as primarily providing that material, uses a "website name, domain name, or subdomain that indicates the website primarily provides material harmful to minors," or advertises it as a primary feature. Nobody counts your files. Your domain and marketing copy do the work, and the presumption is yours to rebut.

Now the sentence everybody is writing about. Subsection (3) used to hold the private damages action, which moved to section 78B-3-1003(1). The deemed location rule quoted at the top took its place.

Subsection (4) is the one agency owners keep missing. A covered site "may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements," including by providing instructions on using one, or "means for individuals in this state to circumvent geofencing or blocking." That is a content rule, not an infrastructure rule. It reaches captions, help articles, pinned posts and support macros.

Enforcement sits with the Division of Consumer Protection under new section 78B-3-1004, which may coordinate with the Attorney General's office and the Internet Crimes Against Children Task Force. The director may impose an administrative fine of up to 2,500 dollars for each violation. In court the division can also seek an injunction, disgorgement of "any money received in violation of this chapter" and a civil penalty of up to 2,500 dollars per violation, and breaching an order carries a further penalty of up to 5,000 dollars per violation.

SB 73 amends Titles 13, 59 and 78B and does not touch Utah's criminal code, so its own remedies are administrative, civil and private. Aylo's counsel still told the court on 30 July that this is "a statute with potential criminal penalties," so do not treat the point as settled.

It also gives you a target. Section 78B-3-1006 deems an entity compliant if it uses a verification method meeting standards the division sets by rule under section 78B-3-1005. Those rules do not exist yet.

Why Geoblocking a State No Longer Limits Who the Law Can Reach

Geoblocking was never a compliance strategy. It was a geography bet: you blocked a state's IP ranges and argued you had no users there, so the statute had nothing to attach to. It worked because the legal test and the technical test were the same test, an IP address standing in for a person.

The deemed location rule breaks that equivalence on purpose. A resident of Salt Lake City exiting through an Amsterdam node is, in the statute's terms, accessing your site from Utah. Your block did not remove her, it removed your ability to see her.

A block is no longer evidence of absence. It is evidence that you tried, which is not nothing, but it does not answer the statutory question.

Your mitigation notice becomes a compliance surface. The courtesy page that says the state is blocked and here is why is where operators drifted into helpfulness. Providing "means for individuals in this state to circumvent geofencing or blocking" is wide enough to cover a link, a tutorial or a support reply.

The options collapse to two. If you are covered, you either verify everyone or accept the exposure, because you cannot verify only the people you can locate. That is the core of Aylo's complaint: as reported by the Deseret News, its filing argues the provision "transforms what is nominally a Utah regulation into a de facto global mandate" and would drive away up to 80 percent of its customers.

Here is the part that lowers your blood pressure. For revenue running through OnlyFans or Fansly, the covered entity is the platform, not your agency. It publishes, holds the gate, and will make its own call without consulting you. Your exposure lives on the surfaces you own. We mapped how the state gates arrived in sequence in the US state age verification rollout schedule, and the wider frame in our overview of age verification laws and OnlyFans agencies.

The Enforcement Pause, the Litigation and What Happens Next

The case is Aylo Freesites Ltd et al v. Utah Division of Consumer Protection et al, number 2:26-cv-00340 in the District of Utah, filed on 22 April 2026 and assigned to Judge David Barlow. On 27 April 2026 the parties agreed to defer enforcement of the challenged provisions until 3 September 2026. On 30 July 2026 the court heard argument on Aylo's preliminary injunction motion, the judge said he could not commit to when he would rule, and both sides then agreed to keep the law on hold until he does. So the operative deadline is now a ruling, not a date.

One exchange there matters more than the calendar. Asked directly, the Attorney General's office and the Division of Consumer Protection both went on record that only a reasonableness standard applies. Aylo's answer: the statute never defines reasonable.

Plan for three endings.

1. Granted. The provision goes on ice, an appeal to the Tenth Circuit is likely, and the question stays open into 2027. Nothing gets easier: other states keep legislating meanwhile.

2. Denied. The hold lifts, enforcement can begin, and the division starts making covered entity determinations against a live statute.

3. Narrower. A court enjoins part and leaves the rest. Section 78B-3-1008 adds a severability clause precisely so a loss on one provision does not take the chapter down, which makes a partial outcome likelier than a clean win.

One date is unconditional. 1 October 2026 is when the tax chapter takes effect, and the tax is not what the injunction motion is about. Do not let a favourable ruling persuade you that October went away.

Where VPN Masked Traffic Hides in Your Analytics

You cannot hold a position on this until you know your own number, and the default tooling hides it. Analytics products resolve geography from the IP address of the request, so a masked session is reported as the exit node's city, confidently and wrongly. The traffic does not vanish from your dashboard. It relocates.

Three tells are reliable enough to act on.

• Metro concentration that does not match population. A handful of metros host disproportionate exit node capacity. When one shows a session share no comparable market comes close to, that is relay traffic.

• Signal disagreement inside one session. Reported country says one thing, browser timezone offset another, device locale a third. One mismatch is a traveller, a stable pattern is masking.

• The 48 hour swap. When a state gate goes live, that state's reported traffic falls and a matching bump appears in exit node metros within about two days. If you never captured the before, you cannot show the after.

The instrument that answers the question is the autonomous system number behind each request, not the city. Datacenter and hosting networks are the strongest single signal of a relayed session, since ordinary fans do not browse from a hosting provider. This is a server side log and a lookup, not a new platform.

Build this week. Add four columns to whatever table holds your traffic: reported region, network type, browser timezone offset, device locale. One row per session on the surfaces you own, kept thirteen months. Treat published relay share figures as marketing until you measure your own, and do not build a VPN blocklist you cannot maintain: exit ranges rotate faster than your ops calendar and the false positives are corporate networks and privacy conscious buyers.

Which Surfaces in an Agency Funnel Are Yours to Gate

Sort every surface on the roster into three buckets and the strategy writes itself.

Bucket one: yours. Domains you own and host, self hosted free sites, custom landing pages, your email and SMS lists. You control the gate, and you carry the covered entity question. This is the only bucket where SB 73 can name you rather than a platform.

Bucket two: someone else's, and they decide. OnlyFans, Fansly, Reddit, X, Instagram, TikTok, Telegram. You cannot install a gate, and their decision can remove a state or a country from your funnel with no notice. Our breakdown of country level blocks and how they hit a roster is the same failure mode.

Bucket three: the vendor middle. Link in bio tools, form builders, email platforms, CDNs, payment pages. You control the content, the vendor controls whether it exists tomorrow, and its adult content policy moves faster than any statute.

The decision rule almost nobody follows: never let a bucket two or three surface be the only path between a fan and a payment. Every creator needs one bucket one surface with an owned email list behind it, the conclusion we reached from the traffic side in the age verification funnel rebuild.

The ratio and the branding presumption also explain something owners have felt but could not justify: a safe for work theme page whose domain says nothing about adult content has a real argument on both tests, and a free preview site fails both.

What Changes for Creators Who Sell Direct Rather Than On Platform

Selling from an owned domain removes the platform's 20 percent and its shield at once. If the creator's own site publishes the material, she or her entity is the commercial entity. Run this test on any direct sale property.

1. Ratio. Is more than a third of the total material on that site material harmful to minors as the statute defines it? Count the site, not the business.

2. Presumption. Does the domain, subdomain or marketing copy indicate it primarily provides that material? If yes, you start on the wrong side of the burden whatever the ratio.

3. Entity. Which legal person operates the site? A creator's personal name on a registrar record is a different exposure from a company with counsel.

4. Assurance. What verification runs today, on what surface, at what point in the flow?

5. Circumvention content. Search every property, social account and support macro for VPN and proxy, then delete or rewrite. Cheapest item on the list, and the easiest to prove against you.

One drafting trap. Section 78B-3-1002(2) says whoever performs verification "shall not retain any identifying information of the individual after access has been granted to the material," and section 78B-3-1003(2) gives an individual a damages action against an entity that knowingly retains it. You must verify and may not keep, which eliminates any vendor storing a document image for its own audit trail. Get one written answer before you sign: does your service return a pass or fail result and hold nothing?

Model the cost correctly. Verification fires on visitors, not buyers, so you pay against free traffic volume rather than paid conversions. Get per check pricing, multiply by top of funnel sessions, and set that beside what the property earns. For many rosters one well run direct property beats five thin ones.

Utah's 2 Percent Excise Tax Bolted to the Same Determination

This is the provision with no headlines and the clearest effect on unit economics, and it starts 1 October 2026. New section 59-35-103 reads: "An excise tax is imposed on a covered entity in an amount equal to 2% of the sales price of covered transactions." Section 59-35-102 defines covered entity as "a commercial entity that is required to perform age verification under Section 78B-3-1002." No separate registration, no separate test: the tax rides on the verification determination.

Covered transaction is defined broadly: paid access to digital images, audio-visual works, audio works, books or gaming services, single use or by subscription.

The referral mechanism is the part to understand. Section 78B-3-1004(7) requires the division to notify the State Tax Commission in writing of any entity it determines must perform age verification, so one determination produces two consequences: a compliance obligation and a tax bill. Collection sits with the commission on quarterly electronic returns, with three years of records required. Revenue splits 90 percent to a Minor Mental Health Restricted Account and 10 percent to a Minor Online Safety Restricted Account that funds enforcement, and the bill appropriated 4,000,000 dollars to Consumer Protection for fiscal 2027. Enforcement is funded by design.

On platform revenue the tax is not yours, because you are not the covered entity. On a direct property determined to be covered, 2 percent comes off the top before your management fee and on top of processing and verification costs, which is why the state tax treatment of your management fees deserves an hour with an accountant. Note also what the enacted definition of covered transaction does not say on its face: that it applies only to purchases by Utah residents. How far the tax reaches is a live question for counsel and the courts.

Reading the Next Wave of Copycat State Bills

Three drafting patterns are circulating, and only one is cheap to copy.

Deemed location. Utah's approach. One sentence, no new duty on any VPN provider or carrier, all the weight on the site.

Block the VPN. Wisconsin's S.B. 130 and companion A.B. 105 would have required covered providers to block users connecting through a VPN. That provision was struck in February 2026 after public and industry pushback, and the bill moved on without it.

Push it to the network. Michigan House Bill 4938, introduced on 11 September 2025, would put the duty on internet service providers to detect and block circumvention tools. Referred to committee, never advanced.

One enacted deemed location statute, one blocking mandate withdrawn under pressure, one network proposal stalled. The pattern that survives regulates publishers rather than infrastructure, because it makes no enemies among carriers and privacy vendors. Read each new bill for three things. Does it pair "actually located" with "virtual private network, proxy server, or other means to disguise"? Utah is being copied close to verbatim. Does it bolt a tax onto the covered entity determination? That changes your economics, not your workload. Does it include a rulemaking safe harbour? That is the difference between a rule you can comply with and one you can only lose under.

Your Utah SB 73 Checklist Before the Hold Lifts

1. Inventory bucket one. Every domain you or a creator owns, with the entity behind it and an honest ratio estimate.

2. Purge circumvention content. Search all properties, socials and support macros for VPN and proxy, then rewrite or delete.

3. Turn on network level logging. Region, network type, timezone offset, locale. Start the clock now.

4. Get one written vendor answer. Pass or fail only, nothing retained.

5. Re-read your mitigation pages. A block notice that helps a user route around the block is a documented act.

6. Assign an owner. One named person, quarterly, watching for the phrase pattern and division rulemaking.

One adjacent point. The reasoning that says a fan's VPN does not move her out of Utah also says a chatter's residential proxy does not move him out of Manila. An analogy, not a holding, but weigh it against our note on antidetect browsers and proxies in agency operations.

This is general information for OnlyFans agency owners, not legal advice, and the central provision it describes is the subject of an undecided injunction motion. Quotations come from the enrolled text of SB 73, and the litigation status is as of 4 August 2026. Take your own properties to a lawyer first. WhaleFinders works white-label as the marketing direction arm inside OnlyFans agencies on flat monthly pricing, 349 dollars single platform, 529 dual, 679 triple and 799 omni per creator per month. We never post, chat or hold credentials, which is why the surface inventory above is the conversation we have with owners. We are on Telegram at t.me/whalefindersupport.

Utah VPN Age Verification FAQ

Does Utah SB 73 ban VPNs?

No. Using a VPN remains lawful, and the statute imposes no obligation on VPN providers or internet service providers. It removes the VPN from the legal analysis: an individual is treated as accessing a covered website from Utah if she is actually in Utah, whatever tool disguises that. The duty falls on the website operator.

Does the law apply to my agency or to OnlyFans?

For revenue running through OnlyFans or Fansly, the covered entity is the platform, because it publishes the material and holds the gate. Your agency is not the publisher and cannot install a verification step there. Where SB 73 can name you is on surfaces you or a creator own and host, if they contain "more than 33-1/3% of total material" that is harmful to minors.

Is Utah SB 73 being enforced right now?

Not the challenged provisions. The law took effect on 6 May 2026, but on 27 April 2026 the state and Aylo agreed to defer enforcement until 3 September 2026 while case 2:26-cv-00340 proceeds. After the injunction hearing on 30 July 2026 both sides agreed to keep the law on hold until Judge Barlow rules, and he gave no timeline. No ruling as of 4 August 2026. Check the docket before relying on this.

Does geoblocking a state still help?

Less than owners assume. A block reduces casual access and shows intent, but it no longer answers the statutory question, because that question is where the person is, not where the packet appears to originate. A blocked state with a masked user base costs you the block and the lost legitimate traffic, and buys none of the protection.

Can I still tell fans to use a VPN?

If the property is a covered site, no, and this is the provision most likely to catch an agency rather than a platform. Section 78B-3-1002(4) prohibits facilitating or encouraging VPN or proxy use to circumvent age verification, expressly including instructions and "means for individuals in this state to circumvent geofencing or blocking." That reaches captions, pinned posts, help pages and support replies. Even where you are not covered, published instructions for routing around a state gate are a bad document to have in evidence.

What is the 2 percent tax and who pays it?

New Utah Code section 59-35-103, effective 1 October 2026, imposes an excise tax "equal to 2% of the sales price of covered transactions" on a covered entity, defined as a commercial entity required to perform age verification under section 78B-3-1002. The Division of Consumer Protection must notify the State Tax Commission of any entity it determines must verify, so one determination creates both the duty and the tax.