Federal judge blocks VPN provisions of Utah's SB 73 age-verification law

A federal judge in Utah has issued a preliminary injunction blocking the VPN provisions of Utah's SB 73, an age-verification law for adult websites. The account comes from the Electronic Frontier Foundation's post (EFF), which welcomed the decision and calls the law an anti-VPN measure.

SB 73 was signed earlier this year. It required adult websites to block VPN users, or to identify the physical location of visitors using VPNs or similar tools that mask network traffic. It also prohibited sites from offering instructions on how to use a VPN to get around the checks. To EFF's knowledge, that made Utah the first state to target the use of VPNs to avoid legally mandated age-verification gates.

The law was initially set to take effect in May 2026. Aylo, the parent company of major adult platforms like Pornhub, challenged it on constitutional grounds straight away. Utah and Aylo first agreed that the state would pause enforcement while the court considered the preliminary injunction request, or until administrative rules setting specific compliance terms were finalized. Those proposed rules, R152-78B, were published by the Division of Consumer Protection at the Utah Department of Commerce on September 1st, and according to the notice they could have taken effect as soon as October 8, 2026. EFF filed formal comments opposing them. Judge Barlow's decision means the rules cannot be enforced pending further action by the court.

Last week, according to EFF, the court halted enforcement of the law's VPN provisions. It ruled the law likely violates the U.S. Constitution's prohibition on laws that significantly burden businesses and people outside Utah's borders. The reasoning: sites must either know every visitor's physical location and block those in Utah, or verify every visitor's age in case they are in Utah. The court wrote that the actual-location provision "in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating." It essentially found that Utah has less burdensome ways to keep Utah minors off adult sites than making all users worldwide comply.

Judge Barlow agreed with Aylo that the statute, as amended, "now essentially imposes strict liability" on entities like it for determining where its users are. The court said the law requires sites to geolocate users "with perfection to avoid liability" while acknowledging "that geolocation perfection is not presently possible." In the court's words, Aylo would need to verify 28 million users, wherever they are, to be safe.

EFF's own technical argument, made in its comments to the Department of Commerce, is that VPNs route traffic through intermediary servers, so destination websites see only the VPN server's IP address. They cannot reliably tell whether a connection comes from Salt Lake City, Seattle or Shanghai. Under the current framework, EFF says, platforms face an impossible choice: block all VPN traffic nationwide or withdraw from Utah entirely.

The state's draft rules required "commercially reasonable geolocation obfuscation detection systems." EFF argues that this too demands a technical impossibility and forces an invasive data collection regime on users everywhere. It calls the Department's suggested heuristics, such as monitoring connection latency or device time zones, notoriously unreliable and easily skewed by normal network conditions, and warns of misclassification, unwarranted blocks and privacy harm beyond Utah.

One point of scope: Aylo's lawsuit does not challenge the provision that prohibits covered websites from sharing information about VPNs. Utah legislators have indicated they may try to revise the law in the next legislative session. EFF says it will keep pushing back against similar anti-VPN proposals in other states.

Key facts

A federal judge (Judge Barlow) issued a preliminary injunction halting enforcement of the VPN provisions of Utah's SB 73, after a challenge by Aylo, parent company of Pornhub.
The court ruled the law likely violates the constitutional bar on laws that significantly burden businesses and people outside the state, because sites would have to age-verify every visitor in case they use a VPN.
The court said the law demands geolocation "with perfection" and that this "is not presently possible"; it noted Aylo would need to verify 28 million users.
Proposed rules R152-78B, published September 1st and possibly effective from October 8, 2026, cannot be enforced pending further court action.
Utah legislators have indicated they may revise the law next session; Aylo's suit does not challenge the ban on sharing VPN information.

Why it matters

To EFF's knowledge, Utah was the first state to target the use of VPNs to avoid age-verification gates, so this is an early court test of that approach. The court's reasoning is that a law demanding perfect geolocation of users, which is not presently possible, effectively forces sites to treat every visitor worldwide as a possible Utah resident. EFF says the preliminary injunction sets an important precedent: state lawmakers should not use age verification to force dragnet tracking or undermine essential security tools.

Who it affects

Adult website operators such as Aylo, which would otherwise have had to block VPN users or verify the age of every visitor. VPN users in and outside Utah, since the court found the law burdens people beyond the state's borders. The Utah Department of Commerce and its Division of Consumer Protection, whose proposed rules R152-78B cannot be enforced while the injunction stands. Lawmakers in other states considering similar anti-VPN proposals, which EFF says it will keep opposing.

How to use it

This is a legal development to follow, not a tool. Readers tracking age-verification or VPN rules can note the specifics: the injunction covers the law's VPN provisions, the proposed rules R152-78B are in the Utah State Bulletin (page 6), and EFF says its full comments to the Department of Commerce are available from its post. Watch for the next legislative session in Utah, where lawmakers may try to revise the law.

How solid is it

The account is EFF's own post, and EFF is an advocate that opposed the law and filed comments against the rules, so its framing is partisan. The court's words are quoted directly in the post: the strict-liability finding, the "perfection" language and the actual-location passage. The source gives no exact date for the ruling, only "last week", and does not give the judge's first name or a case number. The 28 million figure appears only inside the court's quoted wording.

Risks and caveats

The injunction is preliminary, not a final decision, and the rules are blocked only pending further action by the court. It covers the law's VPN provisions; Aylo's lawsuit does not challenge the provision prohibiting sites from sharing information about VPNs. Utah legislators have indicated they may try to rewrite the law, and the source does not say what changes they might make or whether Utah will appeal. The source gives no reaction from Utah officials.

“that geolocation perfection is not presently possible.”

— The court, as quoted by EFF