# Utah's VPN law: what an IP database can and can't tell

Utah's age verification rule asks sites to spot masked locations and tell who's in Utah. We measured how much VPN, relay and geolocation data can answer.

On September 24, Judge David Barlow of the US District Court for Utah blocked the clause of Utah's [SB 73](https://le.utah.gov/Session/2026/bills/enrolled/SB0073.pdf) that counts a visitor who's actually in Utah as accessing a site from Utah "regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location". His [memorandum](https://storage.courtlistener.com/recap/gov.uscourts.utd.163866/gov.uscourts.utd.163866.67.0.pdf) put the problem in one sentence:

> The law requires geolocation perfection, but the parties agree that current technological advancements do not allow an entity to perfectly (1) detect VPN/proxy users, or (2) geolocate where all of those VPN/proxy users are accessing the site from.

On October 8 he [stayed the case](https://www.courtlistener.com/docket/73231364/aylo-freesites-ltd-v-utah-division-of-consumer-protection/) until the end of the Utah Legislature's next General Session, which runs from January 19 to March 5, 2027. The stay leaves the injunction in place.

Utah's [proposed rule](https://rules.utah.gov/wp-content/uploads/b20260901.pdf), published on September 1, asks a site for both. R152-78B defines a "geolocation obfuscation detection system" as one that identifies "whether a person's or device's location is masked" or "whether a person is in Utah", and counts one as commercially reasonable when it's "calculated to enable the commercial entity to identify with at least 95% accuracy whether a person ... is in Utah". On October 16, Utah's Administrative Code still [listed it as a proposed rule](https://adminrules.utah.gov/Rule/3086/55/8139/undefined), and it lapses unless the Division of Consumer Protection makes it effective, or files a change to it, by December 30.

An IP database can do part of each, and we measured how far ours goes as built on October 16, 2026. iCloud Private Relay keeps a visitor's state, and 768 of Apple's address ranges say Utah. A VPN address keeps its server's, and IP Geolocation places 37,183 of VPN IP's IPv4 addresses in Utah.

## Is the location masked?

Four tools make a visitor look like they're somewhere else, and each one looks different to an IP database.

iCloud Private Relay is the easiest to spot. Apple [publishes its relay addresses](https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/), and our [Relay IP](https://internetdata.io/databases/relay-ip) database held all 105,647 IPv4 addresses on Apple's list on October 16.

[VPN IP](https://internetdata.io/databases/vpn-ip) lists commercial VPN servers, with the provider named where we know it. It's rebuilt every day because the list moves: a month-old copy lacked 15.6% of the current one when we [measured it](https://internetdata.io/blog/ip-database-update-frequency) on October 6.

A residential proxy exit is someone's home connection, resold as an exit in whatever state the buyer picks. [Residential Proxy IP](https://internetdata.io/databases/residential-proxy-ip) flags an exit once it's been seen as one, and VPN exits turn up there too: 13.0% of the high-confidence ones we checked on October 7 were in its 90-day list ([Do VPNs use residential IPs?](https://internetdata.io/blog/do-vpns-use-residential-ips)).

A VPN someone runs for themselves is the hardest. A list flags it as a VPN only once a scan has found it answering as one, and until then it's an ordinary address: an ISP's at home, or a hosting company's on a cloud server, which [Hosting IP](https://internetdata.io/databases/hosting-ip) flags as hosting and nothing more. Blocking hosting addresses to stop VPNs is blunt: on September 29, a block on all of Hosting IP covered about 790 addresses for each VPN exit it caught ([Does blocking datacenter IPs stop VPNs?](https://internetdata.io/blog/datacenter-ip-vpn-detection)).

## Is the person in Utah?

For an ordinary connection, [IP Geolocation](https://internetdata.io/databases/ip-geolocation) places the address by country, region and city, and a US address's region is its state. Behind the four tools above, the address says where the tool is, with one exception.

Private Relay keeps the visitor's state. Apple says the relay "preserves the region the user is in, so your server can trust the region assigned to the IP address it sees", and its [list of egress ranges](https://mask-api.icloud.com/egress-ip-ranges.csv) gives each range a region: on October 16, all but 4 of its 181,005 US ranges had one. 768 say Utah, `US-UT`: 114 IPv4 ranges holding 182 addresses, and 654 IPv6 ranges. A site can treat a Private Relay visitor like anyone else, by state, instead of blocking them.

A VPN address is placed where its server is. Where IP Geolocation placed VPN IP's IPv4 addresses on October 16:

| Placed in | VPN IP addresses | With a provider named |
|---|---:|---:|
| Anywhere | 16,263,195 | 4,004,746 |
| The US | 2,835,785 | 976,136 |
| Utah | 37,183 | 6,195 |
| Salt Lake City | 16,099 | 4,332 |

A Utah resident on any of the other 16,226,012 looks like they're somewhere else, which is the case SB 73 was written for. It works the other way too: anyone on one of the 37,183 looks like they're in Utah. That's whoever picks a Salt Lake City server in a VPN app, and the remote staff of a Utah company that runs its own VPN gateway. The 6,195 with a provider named belong to 44 providers, and the other 30,988 answered our scans as VPN servers without a brand we could attach yet.

A residential proxy exit is placed where its household is, a real place in a real state. Without a proxy list's flag, a site sees the same record it would for that household's own traffic.

## What a reasonable check looks like

The proposed rule's safe harbor rests partly on the first question: a site runs a detection system to find visitors who are hiding their location, and requires each of them to share their location to show they're not in Utah, turn the VPN off and verify their age if they are, or verify their age. Utah described a similar method in court. The two sides' experts disputed how reliable the commercial services are, but in the court's words, "no party disputes that they can assist in detecting location-obfuscation technologies."

The rule also lets a site weigh "latent signals", connection latency and the device's time zone among them, to judge whether a visitor is in Utah. Those narrow a visitor to a region, not a state. Aylo estimated about 1.26 million monthly visits from users in the Mountain Time Zone with their browser language set to English, and the court noted that under Utah's method, anyone in that group on a VPN would likely be swept in, "whether they are located in Utah, Colorado, or any other place in the world."

A list can't place a masked visitor, but it can say who's masked, so the extra step falls on them and not on everyone. In terms of the databases:

1. Check Relay IP first, and treat a Private Relay visitor by the region Apple gives the address.
2. Treat a hit in VPN IP, a proxy database or [Tor IP](https://internetdata.io/databases/tor-ip) as a location you don't know, and send that visitor to the location check or age verification rather than blocking them. A Hosting IP hit on its own is a weaker signal: score it, don't block on it.
3. Place everyone else with IP Geolocation, and verify the ones it puts in Utah.
4. Pull the VPN and proxy databases every day.

## How we measured

VPN IP, Relay IP and IP Geolocation are as built on October 16, 2026, and every count from them is IPv4. VPN IP counts every address its file publishes, at every confidence level, and each address takes the place of the IP Geolocation range that holds it. A provider counts in Utah when at least one of its addresses is there. Apple's list was downloaded at 19:42 UTC on October 16. The court record is the memorandum and the docket on CourtListener, which showed no filing after the October 8 order at 19:49 UTC, and the rule's status is Utah's Administrative Code at 20:05 UTC.

Relay IP and Tor IP are open: sign up on the [Relay IP](https://internetdata.io/databases/relay-ip) or [Tor IP](https://internetdata.io/databases/tor-ip) page to download them. To license VPN IP, IP Geolocation and the proxy databases, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).