US VPN Laws (2026): Utah SB 73, Wisconsin and Michigan, State by State

Using a VPN is legal for individuals everywhere in the United States as of October 2026. No federal or state law makes it an offence. What changed in 2026 is that states began writing VPNs into age-verification laws for adult websites. Utah's SB 73 is the one in force, and its duties fall on websites, not users. Wisconsin's bill was vetoed, and Michigan's is stuck in committee.

This tracker sets out what each text actually says, who it applies to, and where it stands, with dates and links to the official records. It's general information, not legal advice. If you run a website affected by these laws, get advice from a lawyer licensed in that state. Outside the US, our country-by-country VPN law guide sets out where use is restricted or banned.

Is using a VPN legal in the US?

Yes. None of the state texts below creates an offence for a person who uses a VPN, and no federal law bans personal VPN use. A VPN is an ordinary privacy and security tool, used daily by businesses for remote work and by individuals on public Wi-Fi. Using one to commit a crime doesn't make the crime legal, but the VPN itself isn't the offence.

The new laws work differently. About half the states, 27 by the count of the Free Speech Coalition (an adult-industry trade group), now require adult websites to verify visitors' ages. A few lawmakers noticed that a VPN can make a visitor appear to be somewhere else. So the 2025-2026 bills tried to close that gap, mostly by telling websites what to do about VPN users.

Utah SB 73: what it requires, from whom, since when

Utah's SB 73, the Online Age Verification Amendments, was signed by Gov. Spencer Cox on 19 March 2026. Press reports say it passed the Senate 22-2 and the House 66-1. It amends Utah's existing age-verification law for websites where more than a third of the material is harmful to minors. Most provisions, including the VPN section, took effect on 6 May 2026. A separate 2% excise tax on covered sales started on 1 October 2026.

Two VPN provisions matter. The first is a location rule in Utah Code 78B-3-1002(3): a person 'actually located' in Utah counts as accessing the site from Utah, even if they use 'a virtual private network, proxy server, or other means to disguise' their location. That makes the site liable if it fails to age-check a Utahn who arrived through a VPN. The second, in 78B-3-1002(4), says such a site 'may not facilitate or encourage the use of a virtual private network' to get round age checks. That covers, for example, giving instructions on using one.

Penalties fall on the companies. The state's Division of Consumer Protection can impose administrative fines of up to $2,500 per violation, courts can add civil penalties of up to $2,500, and violating an order can cost up to $5,000 per violation. An individual can also sue a non-compliant site for damages. None of this applies to a person who simply uses a VPN.

Enforcement: paused, then partly blocked

Enforcement has been stop-start. According to EFF's dated updates, Utah agreed not to enforce the VPN provisions until 3 September 2026. Aylo, the parent company of Pornhub, challenged the law in federal court in Aylo Freesites Ltd v. Utah Division of Consumer Protection (No. 2:26-cv-00340, D. Utah). EFF reported that on 17 September 2026 Utah agreed not to enforce the law against Aylo while the case continued or until its rules were finalised. EFF also reported that the state's proposed implementing rule was open for public comment until 1 October 2026.

Then, on 24 September 2026, Judge David Barlow granted a preliminary injunction. The court docket records an order that the state 'shall not enforce Utah Code section 78B-3-1002(3)', the actual-location rule, 'until further order of this court'. A further order was entered on 8 October 2026, which we have not reviewed. The ban on sites encouraging VPN use was not the subject of that injunction. We'll update this page as the case moves.

Wisconsin and Michigan: the bills and their status

Wisconsin AB 105 drew national headlines as a 'VPN ban'. As introduced, it required adult websites to 'prevent persons from accessing the website' from any IP address 'linked to or known to be' a VPN, in effect making sites block VPN users outright. That clause never became law. The Senate's Amendment 2, adopted on 18 February 2026, struck the VPN-blocking paragraph and added VPN providers to the list of businesses not liable just for providing access. The Assembly agreed the next day. The governor vetoed the bill on 3 April 2026, and the Assembly's attempt to override failed on 13 May 2026. The legislature's page lists it as 'Veto Sustained'.

Michigan HB 4938, the 'Anticorruption of Public Morals Act', was introduced by Rep. Josh Schriver on 11 September 2025 and sent to the House Judiciary Committee the same day. As of October 2026 the legislature's site records no further action. As introduced, it defines 'circumvention tools' to include 'virtual private networks, proxy servers, and encrypted tunneling methods'. It would require Michigan ISPs to 'implement mandatory filtering technology' and to block known circumvention tools. It also says 'the promotion or sale of circumvention tools to access prohibited material is prohibited', with civil fines of up to $500,000 per violation for businesses that knowingly facilitate access. It sets no penalty for a person who merely uses a VPN. Michigan's 2025-26 session ends in December 2026, and a bill that hasn't passed by then lapses.

Other states with age-verification laws

Louisiana's law, effective 1 January 2023, was the first. By the Free Speech Coalition's count, 27 states now have age-verification laws for adult sites, most modelled on the same template. In June 2025 the US Supreme Court upheld Texas's version, HB 1181, in Free Speech Coalition v. Paxton. Writing for the Court on 27 June 2025, Justice Thomas applied intermediate scrutiny and found the law a valid exercise of the state's power to protect minors.

The Free Speech Coalition's tracker lists these states with an age-verification law and an effective date: Alabama, Arizona, Arkansas, Florida, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, North Carolina, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, West Virginia and Wyoming. The most recent effective dates on its list are Iowa (1 July 2026) and West Virginia (12 June 2026). Wisconsin isn't on it, because its bill was vetoed. The tracker carries no as-of date, and the coalition represents the industry these laws regulate, so check the state's own legislature before relying on any single entry.

We read the enrolled text of Texas HB 1181. It requires sites where more than one-third of the material is sexual material harmful to minors to use reasonable age verification, with civil penalties of up to $10,000 a day. It doesn't mention VPNs or proxies at all. We haven't checked every one of the other states' texts, so we don't claim any of them mention VPNs. Press reports describe Utah's SB 73 as the first US law to target VPN use.

What changes for ordinary users

For most people in the US, nothing about using a VPN changes. You can still buy, install and use one for privacy, travel, work or public Wi-Fi in every state. What may change is how some adult websites treat visitors. A site trying to comply with Utah's rules may refuse VPN connections, ask for age verification from more visitors, or block Utah altogether. That's the site's decision under its legal duties, not a rule you're breaking.

Three practical points follow. If a site refuses your VPN connection, the site is managing its own liability; it isn't evidence that VPNs are illegal. Laws aimed at adult sites don't touch the everyday reasons people use VPNs. And the legal picture is moving fast, with court rulings and rulemaking in progress, so check the dates on anything you read, including this page.

Privacy tools remain lawful, and choosing one is a normal consumer decision. Proton VPN offers a free plan with no monthly data cap, and NordVPN had its no-logs claims independently assessed for the sixth time in late 2025, by Deloitte (announced February 2026). Mullvad, which pays us nothing, is another option. For travel beyond the US, our VPN legality guide covers the countries where the rules really are strict.

Timeline

The pattern across all four texts is the same: legislators place obligations on businesses that publish, carry or sell, never on the person at the keyboard. That may change. Watch for any bill that defines an offence for an individual, which none of these does.

If you run a website: what Utah's text asks of you

This section is for site operators, and it is a summary, not legal advice. Utah's VPN provisions apply only to commercial entities whose websites carry a 'substantial portion' of material harmful to minors, which the statute defines as more than a third of the site's material. Most websites, including general publishers, shops and VPN providers' own sites, are outside that definition.

For sites inside it, the text creates two VPN-related exposures. One is the actual-location rule, now enjoined, under which a Utah visitor using a VPN still counts as a Utah visitor. The other is the ban on facilitating or encouraging VPN use to get round age verification, including by giving instructions on using a VPN or proxy to reach the site. A covered site should not publish 'use a VPN' guidance aimed at Utah visitors, whatever happens to the location rule in court. Anyone in that position should take advice from a Utah-licensed lawyer, because the rulemaking and litigation are still live.

What to watch next

Four things will decide where this goes over the coming months. First, the Aylo case in federal court in Utah: the preliminary injunction is not a final ruling, and the 8 October 2026 order may already have moved things on. Second, the Division of Consumer Protection's implementing rule, whose comment period closed on 1 October 2026. Third, Michigan's legislative calendar: HB 4938 lapses if the session ends in December 2026 without action. Fourth, copycat bills. Other states could adopt Utah's location and anti-facilitation wording in their next sessions.

We re-check the official records for this page regularly and date every change. If you see a newer development first, the legislature or court record will be the authoritative source.

Edge cases

• Workplace and school rules: an employer or school can ban VPNs on its own network or devices. That's a policy matter, not state law.
• Streaming and sports services: using a VPN to watch content from another region can break a service's terms, with consequences such as account termination. That's contract law, not a criminal offence.
• Travelling Utahns: Utah's location rule turns on where you actually are. A Utah resident visiting another state is outside it, and a visitor in Utah is inside it.
• Businesses using VPNs: nothing in these laws affects corporate VPNs used for remote access.