In the US and the UK, no age-verification law makes it an offense for an adult viewer to use a virtual private network (VPN) [1][2]. The laws place their duties on websites, and the UK government has said it will not ban VPNs or put them behind age checks [3].
The live legal question is a different one: how far must a site go to keep out visitors who hide where they are? Courts in Utah and Indiana, and several legislatures, are working that out.
Does any US state law penalize people for using a VPN?
Not among the age-verification laws now in effect. The 27 state laws shown on the US map put the duty on the business that publishes adult material, not on the person viewing it. Texas is a typical example: its law requires a commercial entity that publishes such material to use reasonable age verification methods, and the Attorney General can sue that entity for up to $10,000 for each day it operates in violation [1]. Nothing in the Texas chapter makes a viewer liable for skipping or dodging a check [1]. Utah’s law follows the same pattern: the commercial entity must verify ages, and neither it nor a third-party verifier may keep identifying data [4].
Under these statutes, a visitor who appears to be somewhere else is a compliance problem for the site, not an offense by the visitor [1][4].
What does Utah’s VPN provision say?
Utah wrote VPNs into its law. SB 73, in effect since May 6, 2026, added two VPN clauses to the state’s 2023 statute [4].
- Actual location. Utah Code § 78B-3-1002(3) says a person counts as accessing a site from Utah if they are actually in Utah, “regardless of whether the individual is using a virtual private network” or a proxy [4].
- No help with workarounds. Section 78B-3-1002(4) says a covered site may not facilitate or encourage the use of VPNs, proxies or other means to get around age verification, including by giving instructions or offering ways around geofencing [4].
Both clauses are rules for sites. The first sets when a site’s age-check duty applies; the second limits what a site may do. Neither creates a penalty for the person using a VPN [4]. The full record is on the Utah page.
Is Utah’s VPN provision blocked by a court?
Part of it is. On September 24, 2026, Judge David Barlow of the US District Court for the District of Utah granted Aylo, Pornhub’s parent company, a preliminary injunction against the actual-location clause, § 78B-3-1002(3), on dormant Commerce Clause grounds [5]. He found the clause would in effect require sites to “geolocate its website users with perfection,” which both sides agreed is not possible today [5]. Utah’s Attorney General had told the court the state would expect only reasonable efforts; the judge said the statute’s text does not say that [5]. He rejected Aylo’s separate extraterritoriality argument and declined to limit the core age-verification duty, which Aylo had not challenged [5].
The order names only subsection (3), so it does not reach the bar on facilitating workarounds in subsection (4) [5]. On October 7, both sides asked the court to pause the case because the Legislature may amend the clause in its 2027 session [6]. On October 8, the court stayed proceedings until that session ends, with a joint status report due March 19, 2027 [7]. The stay pauses the lawsuit, not the injunction [6][7].
Did Wisconsin try to make sites block VPNs?
Yes, at first. Assembly Bill 105, introduced in March 2025, would have required adult sites to verify ages and also to block visitors from any IP address “linked to or known to be a virtual private network” [8]. The Assembly passed it 69-22 on March 20, 2025 [9].
In the Senate, Amendment 2 deleted the VPN-blocking paragraph and added VPN providers to the list of companies not liable merely for providing access [10]. The Senate adopted that amendment on February 18, 2026, and the Assembly agreed the next day [9]. Governor Tony Evers vetoed the whole bill on April 3, 2026, objecting that it would make adults hand over sensitive personal information to reach legal material [11]. On May 13, under the joint rule for vetoed bills, it was recorded as having failed to pass [9]. Wisconsin has no age-verification law for adult sites.
What would Michigan’s HB 4938 do about VPNs?
HB 4938 is not an age-verification bill. The “Anticorruption of Public Morals Act,” introduced on September 11, 2025, would make it a felony to distribute a broadly defined range of sexual material online, from video to written erotica, with prison terms of up to 25 years [12]. It would require internet providers in Michigan to filter that material and to “actively monitor and block known circumvention tools,” a term the bill defines to include VPNs, proxy servers and encrypted tunnels [12]. It would also prohibit the promotion or sale of those tools to reach the material [12].
The bill was referred to the House Judiciary Committee and has had no further action [13]. See Michigan for the state’s other pending bills.
Does Indiana say adult sites must block VPN users?
Indiana’s statute does not mention VPNs, but its Attorney General argues that complying with it means dealing with them [14]. In a suit filed December 3, 2025, in Marion Superior Court against Aylo companies, the state says its investigators reached Aylo sites from Indiana through a VPN showing a Chicago IP address, and found only a box asking visitors to confirm they were 18 [15]. The complaint says IP-based restrictions “are unreliable and do not prevent minors in Indiana” from reaching explicit material [15]. In the state’s view, location blocks alone do not satisfy the law [14].
The industry has its own reading of that risk. The Free Speech Coalition, the adult industry’s trade group, has said sites might still be liable when a user in a state with a law gets around geotargeting with a VPN [16]. The case’s status is tracked on the Indiana page.
Is it illegal to use a VPN in the UK?
No. The Online Safety Act puts its age-check duties on service providers: a site that publishes pornography must use age verification or age estimation that is “highly effective” at telling whether a user is a child [2]. Those duties bind providers, not viewers [2].
Ofcom, the regulator, has said the Act does not require services to block all VPN traffic, that VPNs are “lawful to use in the UK,” and that it has no power to order such blocking [17]. Services should not, however, host content that directs or encourages children to get around age checks, for example by linking to a VPN [17]. In July 2026, responding to its consultation on children online, the government said it “will not ban or age-gate VPNs” [3]. It has asked Ofcom to research how services can detect VPN traffic and stop children using VPNs to bypass safeguards, and says it is prepared to act further if circumvention is not tackled [3]. More on the UK.
Why do civil-liberties groups object to VPN rules?
Digital-rights groups argue that VPN rules are unworkable and harm privacy. The Electronic Frontier Foundation says a website cannot tell where a VPN user really is, so a state VPN rule in practice means blocking VPN users everywhere, and it notes that remote workers, students, journalists and abuse survivors rely on VPNs [18]. It kept opposing Wisconsin’s bill after the VPN clause was dropped, objecting to ID checks themselves [19]. The UK’s Open Rights Group says detecting VPN use is technically unworkable and would need intrusive analysis of people’s traffic [20].
Governments see it differently. Indiana argues that blocks a VPN can defeat leave minors unprotected [15], and Utah defended its rule as asking only for reasonable efforts [5]. The UK government says VPNs must not be misused to undermine child safety, though the children’s charity NSPCC told the consultation that a ban would strip away VPNs’ protections without making children safer [3].
What is the bottom line on VPNs and age-verification laws?
- Users: No US age-verification law in effect makes it an offense for an adult to use a VPN [1][4]. In the UK, VPNs remain lawful and the government says it will not ban or age-gate them [17][3].
- Sites: Utah’s actual-location rule is on hold under the September injunction, while its bar on sites helping with workarounds still applies [5]. Indiana argues that geoblocking a VPN can defeat does not satisfy its law [15]. Ofcom says UK services should not encourage children to use VPNs to get past age checks [17].
- Pending: Utah’s Legislature may revisit the location rule in its 2027 session, with a court status report due March 19, 2027 [6][7]. Indiana’s December 2025 suit against Aylo is pending [15]. Michigan’s HB 4938 sits in committee [13]. In the UK, Ofcom is researching VPN detection and the government has promised a further update [3].
Places in this guide
Utah · Indiana · Wisconsin · Michigan · United Kingdom