The new law explicitly addresses VPN use in Section 14, which amends Section 78B-3-1002 of existing Utah statutes in two primary ways:

Regulation based on physical location: Under the law, an individual is considered to be accessing a website from Utah if they are physically located there, regardless of whether they use a VPN, proxy server, or other means to disguise their geographic location.

Yeah, that part's gonna get killed by the courts when it inevitably gets challenged, because the US is never going to accept the same doctrine in reverse, where, for example, a Utah company would be subject to, say, liability under sharia law because someone in Iran is accessing it and they touch a Utah-based company that doesn't conform to sharia law, though it looks like they're coming from Salt Lake City.

The Utah legislature is dominated by white Mormon men, who care more about protecting the Mormon church and lining their own pockets than anything else.