Disclosure: VPN Vetted is reader-supported. A few links near the end of this guide are affiliate links (marked “sponsored”): if you buy through them we may earn a commission at no extra cost to you. The legal sections contain no affiliate links. NordVPN and Surfshark both belong to Nord Security.
Not legal advice: This guide is general information, not legal advice, and we are not lawyers. Laws and court cases change; everything here was checked October 17, 2026. For a question about your own situation, talk to a lawyer licensed in your state.
Last updated October 17, 2026 · Laws, court records, prices and features checked October 17, 2026 on official pages (USD).
Short answer
Yes. Using a VPN is legal in the United States. We found no federal law that makes using one a crime, and the Federal Trade Commission’s 2018 guidance describes VPN apps as one way people shield traffic on public Wi-Fi, while warning they don’t make you anonymous. What a VPN doesn’t do is change the legality of what you do through it: a crime is still a crime with a VPN on.
The 2026 development to know is in Utah. SB 73 says that, for its adult-content age-verification law, a visitor physically in Utah counts as accessing from Utah even when using a VPN. That rule binds websites, not VPN users, and a federal judge blocked it on September 24, 2026.
Federal law: no ban on VPNs
The main federal computer-crime law targets conduct, not tools. The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, makes it a crime to intentionally access a computer “without authorization” or to “exceed authorized access” and obtain information (18 U.S.C. § 1030). The statute doesn’t mention VPNs; what matters is whether you had permission to access a system.
The Supreme Court narrowed “exceeds authorized access.” In Van Buren v. United States (2021), the Court held that a person exceeds authorized access when they enter parts of a computer, such as files, folders or databases, that are off-limits to them (Supreme Court opinion).
Federal prosecutors’ policy on terms of service. In May 2022 the Justice Department told prosecutors that violating an access restriction in a website’s terms of service is not, by itself, enough to warrant federal criminal charges under the CFAA (DOJ announcement). It’s a policy, not a law, and can change.
The FTC’s 2018 guidance describes VPNs as a privacy tool, with caveats. The FTC’s 2018 business guidance blog post explains that a VPN app can shield data sent over public Wi-Fi, and lists what to check before installing one: research the app, review its permissions, confirm it encrypts traffic, and read whether it shares data with third parties. It also warns that a VPN “generally isn’t going to make you entirely anonymous” because it shifts trust from your network to the VPN provider (FTC business blog, FTC press release).
State laws
Computer-crime laws exist in every state, and they target conduct. According to the National Conference of State Legislatures, all 50 states, Puerto Rico and the U.S. Virgin Islands have computer-crime laws, and most address unauthorized access or computer trespass (NCSL, updated May 4, 2022). Like the CFAA, these laws focus on getting into systems without permission, not on which privacy software you run.
Age-verification laws are the newer category. They require certain adult-content websites to verify visitors’ ages. We examined Utah’s because its text names VPNs and a federal court has ruled on that provision. Other states word theirs differently.
| Level | What it targets | Does it ban using a VPN? |
|---|---|---|
| Federal (CFAA) | Accessing computers without authorization or beyond authorized access | No; the statute doesn’t mention VPNs |
| States (computer-crime laws) | Unauthorized access, computer trespass, malware and similar conduct | No; NCSL describes them as conduct-based |
| Utah SB 73 (2026) | Duties of commercial websites with a substantial portion of adult content | No; it regulates websites, and its VPN “actual location” provision is enjoined |
Sources linked in each section; checked October 17, 2026.
What Utah’s SB 73 says and the court ruling
What the “actual location” provision requires
Utah’s SB 73 (2026 General Session), sponsored by Sen. Calvin R. Musselman and Rep. Steve Eliason, rewrote the state’s law on liability for publishers and distributors of material harmful to minors. Most of it took effect May 6, 2026 (SB 73 enrolled text). The law applies to a commercial entity that knowingly publishes such material from a website where it makes up a “substantial portion” (more than one-third) of the content. Those sites must use reasonable age verification.
The VPN language sits in Utah Code § 78B-3-1002(3): “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent …” the visitor’s location. The provision defines where a visitor counts as located for the website’s obligations. Nothing in SB 73 makes it an offense for an individual to use a VPN. Enforcement runs against commercial entities, through the Division of Consumer Protection, with administrative fines of up to $2,500 per violation (§ 78B-3-1004).
The September 24, 2026 preliminary injunction
Two Aylo companies sued the Utah Division of Consumer Protection, its director, the Utah Department of Commerce and its executive director in federal court (Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340-DBB-JCB, D. Utah). On September 24, 2026, U.S. District Judge David Barlow granted the challengers’ motion for a preliminary injunction against § 78B-3-1002(3) (Memorandum Decision and Order). The separate injunction order filed the same day bars the defendants from enforcing that subsection “until further order of this court” (case docket).
The court found the challengers were likely to succeed on their claim that the provision violates the dormant Commerce Clause. Because the provision has no “reasonable” qualifier, the court read it as requiring websites to know visitors’ physical locations with certainty, which both sides agreed no website can do. The court also noted that VPNs have “entirely legitimate purposes—such as securing communications on public networks, preventing websites from harvesting personal data,” among others.
This is a preliminary ruling, not a final judgment. In a joint status report filed October 7, 2026, both sides said the Utah Legislature may consider amending the statute and asked the court to pause the case until after its next General Session, which they said is scheduled for January 19 to March 5, 2027 (joint status report). The court granted that stay on October 8, 2026 (docket). The injunction stays in place until the court orders otherwise.
What’s still in force
The injunction covers only § 78B-3-1002(3); the order leaves the rest of the act in place. That includes:
- Age verification for covered websites (§ 78B-3-1002(1)).
- A ban on covered websites encouraging or facilitating VPN use in connection with their age checks, including by providing instructions on how to use a VPN or proxy server to access the website (§ 78B-3-1002(4)). Like the rest of the law, this applies to the websites, not to individuals.
- Division enforcement and rulemaking powers (§§ 78B-3-1004 to 1005).
Proposed rule R152-78B. The Division of Consumer Protection published a proposed rule in the Utah State Bulletin on September 1, 2026 (Utah State Bulletin, Vol. 2026, No. 17). It would define “commercially reasonable” age verification and location-detection standards for covered websites, including a 95% accuracy benchmark and a safe harbor. Comments were accepted until October 1, 2026, and the notice listed October 8, 2026 as the earliest date the rule could take effect. We could not confirm on an official page whether it has been made effective. The court said it did not consider the proposed rule.
What a VPN does and doesn’t make legal
A VPN encrypts your traffic to the VPN server and changes the IP address websites see. It doesn’t change which laws apply to you.
- Crimes stay crimes. Fraud, harassment, unauthorized access and other offenses are just as illegal with a VPN on. The CFAA and state computer-crime laws look at conduct.
- Copyright still applies. Federal law defines anyone who violates a copyright owner’s exclusive rights as an infringer (17 U.S.C. § 501). A VPN doesn’t change that.
- Terms of service are usually a contract question. Websites, employers and schools set their own rules. Breaking them can get your account closed or lead to discipline at work or school, and the DOJ’s 2022 policy says terms-of-service violations alone shouldn’t be charged federally. That’s not a guarantee, and it doesn’t cover entering systems you aren’t authorized to use.
Where a VPN helps is privacy and security, especially on public or untrusted Wi-Fi. See best VPN for public Wi-Fi. A VPN won’t remove your data from broker sites or protect a leaked password; for those, see what to do after a data breach, best data removal service, Incogni vs Aura, best identity theft protection and best password manager for families.
VPNs we’d pick for privacy
This isn’t a full ranking. Both picks offer a kill switch and independent no-logs audits; the order follows the facts below, not commissions.
Our privacy picks
Our opinion: NordVPN edges ahead on audit recency; Proton is stronger if you want to read the reports yourself or start free. See our Proton VPN review.
How we evaluated
We read the primary sources listed below: statutes, the Supreme Court opinion, DOJ and FTC pages, Utah’s enrolled bill, the court’s decision and docket, and the Utah State Bulletin. NCSL’s comparative report covers the state overview. News coverage was background only. For the two VPN picks, we checked official pricing and audit pages. We’re not lawyers, and this isn’t legal advice.
FAQ
Is using a VPN illegal in the US? No. We found no federal law against it; federal and state computer-crime laws target conduct such as unauthorized access. Illegal activity stays illegal with a VPN on.
Did Utah ban VPNs? No. SB 73 regulates commercial websites with a substantial portion of adult content, not VPN users. Its VPN location provision has been blocked by a preliminary injunction since September 24, 2026.
Can I get in trouble for using a VPN at work or school? Possibly, under that organization’s rules: employers and schools set policies for their networks and devices, and breaking them can lead to discipline. Accessing systems you aren’t authorized to use is a separate legal issue. Check the policy, and ask a lawyer about a specific situation.
Is it legal to use a VPN on public Wi-Fi? Yes. The FTC’s 2018 guidance describes VPN apps as one way to shield traffic on public networks, while warning they don’t make you anonymous. The network’s owner can still set its own terms of use.
Does a VPN make it legal to do things that are otherwise illegal? No. A VPN changes how your traffic travels, not what the law allows. Copyright infringement, fraud and unauthorized access are illegal with or without one.
Are VPN laws different by state? Each state has its own computer-crime laws, and some have age-verification laws for adult websites. Utah’s 2026 law is the one we examined that names VPNs, and that provision is enjoined. We haven’t reviewed every state’s code, so check yours.
Verdict
Using a VPN is legal in the US, and the FTC’s 2018 guidance describes it as a privacy tool. The laws that matter target what you do, not the VPN. Utah’s 2026 VPN location rule applies to websites and is on hold under a preliminary injunction. This is general information, not legal advice. For a privacy VPN, NordVPN and Proton VPN both have independent no-logs audits.
Get NordVPN · Or check Proton VPN
Sources (official pages, checked on October 17, 2026)
- 18 U.S.C. § 1030 (CFAA), Legal Information Institute: https://www.law.cornell.edu/uscode/text/18/1030 (checked October 17, 2026)
- Van Buren v. United States, No. 19-783 (U.S. June 3, 2021): https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf (checked October 17, 2026)
- U.S. Department of Justice, new CFAA charging policy (May 19, 2022): https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act (checked October 17, 2026)
- FTC, “In the market for a VPN app?” (Feb. 22, 2018): https://www.ftc.gov/business-guidance/blog/2018/02/market-vpn-app (checked October 17, 2026)
- FTC press release, tips for using VPN apps (Feb. 22, 2018): https://www.ftc.gov/news-events/news/press-releases/2018/02/ftc-provides-tips-using-vpn-apps (checked October 17, 2026)
- NCSL, Computer Crime Statutes (updated May 4, 2022): https://www.ncsl.org/technology-and-communication/computer-crime-statutes (checked October 17, 2026)
- Utah SB 73 (2026 General Session), enrolled copy: https://le.utah.gov/Session/2026/bills/enrolled/SB0073.pdf (checked October 17, 2026)
- Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340, Memorandum Decision ECF No. 67 (Sept. 24, 2026): https://law.justia.com/cases/federal/district-courts/utah/utdce/2:2026cv00340/163866/67/ (checked October 17, 2026)
- Same case, docket (CourtListener mirror of PACER), incl. Order Granting Preliminary Injunction (Sept. 24, 2026) and docket text order staying the case (Oct. 8, 2026): https://www.courtlistener.com/docket/73231364/aylo-freesites-ltd-v-utah-division-of-consumer-protection/ (checked October 17, 2026)
- Same case, Joint Status Report, ECF No. 70 (Oct. 7, 2026): https://storage.courtlistener.com/recap/gov.uscourts.utd.163866/gov.uscourts.utd.163866.70.0.pdf (checked October 17, 2026)
- Utah State Bulletin, Sept. 1, 2026 (Vol. 2026, No. 17), proposed rule R152-78B: https://rules.utah.gov/wp-content/uploads/b20260901.pdf (checked October 17, 2026)
- 17 U.S.C. § 501, Legal Information Institute: https://www.law.cornell.edu/uscode/text/17/501 (checked October 17, 2026)
- NordVPN pricing (US view, USD): https://nordvpn.com/pricing/ (checked October 17, 2026)
- NordVPN no-logs assurance engagement 2025: https://nordvpn.com/blog/nordvpn-no-logs-assurance-engagement-2025/ (checked October 17, 2026)
- Proton VPN pricing: https://protonvpn.com/pricing (checked October 17, 2026)
- Proton VPN for Mac / features (open source, Swiss): https://protonvpn.com/download-macos (checked October 17, 2026)
- Proton VPN no-logs audit: https://protonvpn.com/blog/no-logs-audit (checked October 17, 2026)