Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
There is no federal law restricting VPNs, no state has succeeded in banning them, and nothing on any statute book makes running one an offence.
What changed is subtler and more interesting. Twenty-seven states now require age verification for commercial adult sites, and one of them has written into law that you remain legally located where you actually are — whatever address your connection presents.
That sentence is the whole article. A VPN changes what a website sees. It does not change what the law says about where you were sitting.
Is a VPN Legal in the US?
Yes, in every state and federally. No American law criminalises using a VPN, and two 2025 bills that would have restricted them both died. Twenty-seven states require adult sites to verify age, but those duties fall on platforms rather than visitors. Utah is the only state whose law mentions VPNs at all, and those provisions are on hold.
What Changed in June 2025
One Supreme Court decision explains why the map looks the way it does now.
Free Speech Coalition v. Paxton upheld Texas’s age-verification law 6–3. The Court applied intermediate scrutiny rather than strict scrutiny, which is the part lawyers noticed and headlines skipped.
That lowered the bar for every similar law. Under strict scrutiny most of these statutes would have struggled. Under intermediate scrutiny they largely survive.
The result is visible in the count. Louisiana, Utah, Texas and Virginia went first from 2022. By August 2026 twenty-seven states required verification, and no enacted adult-content age-verification law was blocked by any court.
⚠️ None of them creates an offence for a visitor. The obligations sit on the platform, enforced through fines and civil liability. That distinction holds across all twenty-seven, and it is worth carrying into the rest of this page.
The Rule That Actually Matters
Here is the mechanism, and it is the reason this question deserves more than a one-word answer.
Utah’s SB 73, signed on 19 March 2026, deems users legally located in Utah regardless of VPN use. It is the only enacted American law with explicit VPN language.
But the principle is not unique to Utah. Every one of these statutes assigns liability based on where a user actually is. A platform serving a Utah resident owes Utah duties whether or not that resident’s traffic arrived from Frankfurt.
Which reframes what a VPN accomplishes here. It changes the platform’s information, not your legal position. If a state’s law applies to you, it continues to apply.
⚠️ We are not going to write instructions for defeating age assurance. The measures exist to keep children away from adult material, that is a reasonable aim, and Utah’s law separately prohibits platforms from publishing VPN how-to material for that purpose. This page explains a legal position and does not offer a method.
Two States Tried, and Both Bills Died
The American answer to the question Britain settled in Parliament arrived differently: through legislation that failed.
Michigan House Bill 4938 was introduced on 11 September 2025 by six representatives. Titled the Anticorruption of Public Morals Act, it would have required internet service providers to monitor and block circumvention tools outright.
Wisconsin Assembly Bill 105 went at it from the other side, requiring adult sites to verify age and block any connection arriving through a VPN — including from users who had already verified. It passed the State Assembly.
Both are now dead.
The objections were structural rather than partisan. A state mandating ISP-level blocking of interstate internet traffic runs into the Commerce Clause, and VPNs carry a long record of protecting journalists and activists that makes a blanket prohibition hard to defend on First Amendment grounds. Proton’s US public policy manager warned publicly that a bill like Michigan’s risked poisoning the wider debate, and the Electronic Frontier Foundation described the approach as surveillance presented as safety.
⚠️ Dead bills are not permanent answers. Both could return in a redrafted form, and the Wisconsin version had already cleared one chamber. That is a live risk rather than a settled question.
One Law Survived, and It Is on Hold
Utah’s is the exception, and its timing makes it worth watching this week.
SB 73 does two things beyond the location rule. It prohibits covered platforms from publishing instructions for using a VPN to reach restricted material.
Its VPN provisions are stayed until 3 September 2026, pending a constitutional challenge brought by Aylo, the company behind Pornhub.
So the only American law that names VPNs has not yet operated. Whether it does will tell you more about the next two years than anything in the twenty-six other states.
⚠️ Nothing in it penalises a user, even if the stay lifts. The prohibitions bind platforms. That is consistent across every enacted law we examined.
The Blocking You Meet Is a Business Decision
Worth separating, because people reliably attribute it to the wrong party.
When Pornhub goes dark in a state, the state did not block it. Aylo chose to geo-block those states rather than build verification systems, and has said so publicly.
Other platforms made the same call. Bluesky became unreachable in Mississippi from late August 2025 without a workaround.
Which means the friction is commercial, and it moves. A company that finds verification cheaper than losing a state will build it, and the block disappears without any law changing.
⚠️ The surges were real and predictable. Florida saw VPN demand rise around 1,150% after its law took effect on 1 January 2025. That is a measurement of demand rather than of lawbreaking — nothing about installing a VPN was ever unlawful there.
| Country | What the rule aims at | Reaches the user? |
|---|---|---|
| Turkey | The tunnel — ISPs must block | No |
| The UAE | Conduct behind an address | No |
| India | The provider's records | Not nationally |
| China | Provider, tunnel and user | Yes |
| Brazil | Nothing, until a court acts | For 39 days |
| Indonesia | Paperwork — registration | No |
| The UK | The destination you visit | No, and ministers said so |
| The US | The platform, state by state | No, in all twenty-seven |
| Russia | The search, not the tool | Only if you went looking |
| Australia | The platform, and the tunnel itself | No — platforms must detect it |
| France | The VPN provider itself | No, the orders bind five companies |
| Italy | The provider, by regulator order | No, but one VPN left the market |
| Spain | The provider, by injunction without a hearing | No, and only two firms were named |
| Germany | The provider's logfile, for three months | No, and the courts twice removed it |
How the US Compares
Across the frameworks in this series, the American one is the only federal system in the set.
Turkey regulates the tunnel. Internet providers must block VPN services.
The UAE regulates conduct. The statute never names VPNs.
India regulates records. Five years of subscriber data.
China regulates all three, and names a figure for the individual.
Brazil regulates nothing until a court acts.
Indonesia regulates paperwork, withdrawing access from services that miss a filing.
The UK regulates the destination and said so out loud, ruling out restrictions on VPNs in July 2026.
Russia regulates the search. One provision reaches a person, and it is about what they looked for rather than how they connected.
Australia regulates the platform and the tunnel. No penalty touches a user, and the regulator tells the platforms to detect VPN traffic themselves.
The US regulates by state, and the states disagree. That is the structural difference: twenty-seven answers rather than one, two attempted bans that failed, and one enacted law whose VPN clauses have not yet taken effect. Our wider legality guide covers why the legal-or-illegal framing answers this badly nearly everywhere.
And the ordinary reasons remain ordinary. What a VPN actually hides is narrow, which makes your provider’s own record the thing that matters — Proton VPN publishes five annual audits, NordVPN runs servers that retain nothing between reboots, and only three free tiers are worth trusting anywhere. If you are wondering whether you need one at all, we answer that without a sales pitch.
How We Research
This page draws on the Supreme Court’s June 2025 decision in Free Speech Coalition v. Paxton and published analysis of the standard of review it applied, state-by-state trackers of enacted age-verification laws current to August 2026, the text and status of Utah SB 73 including the stay on its VPN provisions, the introduced text and legislative history of Michigan HB 4938 and Wisconsin AB 105, and published statements from Proton and the Electronic Frontier Foundation. State legislation moves quickly and trackers disagree at the margins on which states are counted; where they do, we give the figure with its date attached. We are not lawyers and this is not legal advice. We do not publish methods for defeating age assurance. Our full approach lives on the About Us page.
US VPN Legality FAQ
No. There is no federal restriction and no state has banned VPN use. Twenty-seven states require adult sites to verify visitor age, but those obligations fall on the platforms rather than on the people visiting them. Two 2025 bills that would have restricted VPNs both failed.
Two did in 2025. Michigan House Bill 4938 would have required internet providers to monitor and block circumvention tools. Wisconsin Assembly Bill 105 would have required adult sites to block VPN connections even from verified adults, and passed the State Assembly. Both bills are now dead.
Utah SB 73, signed in March 2026, deems users legally located in Utah regardless of VPN use, and prohibits covered platforms from publishing instructions for using VPNs to reach restricted content. Its VPN provisions are stayed until 3 September 2026 pending a constitutional challenge.
Usually because the platform chose to leave rather than comply. Aylo, which operates Pornhub, geo-blocks entire states rather than building age verification systems. That is a company’s business decision rather than a government prohibition on the content.
No. Liability under these statutes is based on where you actually are, not on the address your connection presents. Utah wrote that principle explicitly into its law, but it holds structurally in the other states too. A VPN changes what a website sees, not your legal position.
The Verdict
Using a VPN is legal everywhere in the United States, federally and in all fifty states. No enacted law criminalises it, and the two bills that would have restricted it both died in 2025.
Twenty-seven states now require age verification for commercial adult sites, and those duties land on platforms rather than on visitors. The Supreme Court removed the main constitutional obstacle in June 2025 by applying intermediate scrutiny.
Utah is the only state that legislated about VPNs, and it did so by declaring that your legal location does not change when your address does. Those provisions are stayed until 3 September 2026.
Which leaves the honest summary. A VPN in America changes what websites see and nothing about which laws apply to you. That was always true; one state has now written it down.