Do age verification laws apply based on where the user is?

Last reviewed 20 October 2026

Yes: state age verification laws apply to people in the state, and Utah’s 2026 amendment counts a visitor as accessing a site from Utah if they are actually there, whatever VPN or proxy they use, though a federal court blocked that provision in September 2026 while the challenge proceeds.

The location comes first

A state law can only require age checks for people it covers, and it covers people in the state. So before a site asks for proof of age, it has to answer a different question: is this visitor in the state at all?

Utah’s rule on VPNs

An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.

The same section bars covered sites from helping users “circumvent geofencing or blocking.” In September 2026 a federal judge blocked the actual-location provision while the challenge proceeds (KUER). Check the current status before relying on it.

Under a rule like Utah’s, an IP address in another state does not settle whether the law applies.

What that asks of a site

• A location method that a VPN does not move. See IP vs device geolocation.
• A way to handle visitors the check cannot place, rather than guessing. See location verdicts.
• As little personal data as possible, since the visitor has not yet been verified for anything. See verifying location without collecting it.

Octet Browser answers at country level, not state level, so for a state law like Utah’s the check has to run in an app. Our comment on Utah’s rule is in Age verification is a location problem. Not legal advice.