Utah SB 73: Verifying Location for Age-Gate Compliance
Utah's age-verification law expects proportionate measures and proof you took them. Here's how to detect VPN and proxy masking at the gate and keep a defensible record.
Utah's age-verification rules (SB 73) put the operator on the hook for letting the wrong users through an age gate. The catch most teams miss: a plain location check is not a defensible measure, because the easiest signal to read is also the easiest to fake.
What the law actually asks for
Strip away the detail and two obligations remain. First, take a proportionate technical step to verify the user before granting access. Second, be able to show you took it. A flag that says "allowed" with nothing behind it does not meet the second test.
That second part trips people up. You can build a perfect gate and still fail an audit if the record can be edited after the fact or does not exist at all.
Why raw geolocation fails the first test
IP geolocation is reliable at country level right up until someone puts a VPN in the way. Then the location you read belongs to the VPN server, not the person. Relocating the apparent IP is the entire point of a VPN, so trusting geolocation without checking for masking is trusting the easiest thing to spoof.
Check whether a connection is masking its origin
The measure that holds up
- Read the origin, then check it for masking with VPN detection and proxy detection. A VPN, residential proxy, datacenter range or Tor exit means the location is untrusted.
- Map the verdict to an action. Under a strict regime like Utah, a masked origin at an age gate should block or step up to stronger verification, not pass.
- Seal the result. Write each check to a tamper-evident record so you can prove later that you ran it and what it returned.
Why the record has to be tamper-evident
An audit log you can quietly edit proves nothing. The fix is a hash chain: each entry stores a hash of the previous entry plus the check payload. Change any historical row and every link after it breaks, which a verification pass catches immediately. That is the difference between "we have logs" and "we can prove this log was not touched."
This is what Provenance does in one server-side call: it runs the same engine behind our VPN and proxy detection, applies per-jurisdiction policy, and seals every verdict into a hash-chained audit log you can export as signed evidence.
A practical gate
| Origin | Under Utah policy | Record |
|---|---|---|
| Clean residential | Allow | Logged with verdict |
| VPN / proxy / Tor | Block or step up | Logged with reason |
| Ambiguous | Step up | Logged for review |
Bottom line
Utah SB 73 is not satisfied by a country-from-IP guess. Detect whether the origin is masked, act on that verdict, and keep a record nobody can rewrite. Pair the technical control with your age-assurance vendor and counsel, and keep the evidence export ready for the day someone asks how you checked.
FAQ