A Utah VPN law injunction has temporarily stopped the state from enforcing a provision that made adult websites responsible for a visitor’s physical location even when that visitor used a VPN or proxy. U.S. District Judge David Barlow granted the preliminary injunction on Sept. 24 in a suit brought by Aylo, the parent company of Pornhub, according to Gizmodo.
The order is narrow and preliminary. It pauses enforcement of SB 73’s “actual-location” provision while the case proceeds; it does not strike down Utah’s wider age-verification requirements for adult sites, which have been in place since 2023.
SB 73 says a person is accessing a covered website from Utah when they are physically in the state, regardless of whether they use a VPN, proxy, or another method that masks location. The statute does not ban VPN use outright, according to the Electronic Frontier Foundation.
Why did the judge block Utah’s VPN location rule?
The problem was not that a website could not make a reasonable guess from an IP address. The statute, as Judge Barlow read it, exposed sites to liability if they got a VPN user’s true location wrong. VPNs route traffic through intermediary servers, so a destination site sees the server’s IP address rather than a reliable reading of where the user is sitting.
The parties agreed that no available system can perfectly identify every VPN or proxy connection and then determine the user’s actual physical location, according to the court language reproduced by Techdirt. That turns a Utah-only obligation into a much broader compliance problem: a site seeking certainty could have to verify every visitor’s age, including people with no connection to Utah.
Judge Barlow concluded that Aylo was likely to succeed on its claim under the dormant Commerce Clause, the constitutional doctrine that limits state laws from placing excessive burdens on interstate commerce. As reported by Gizmodo, the judge found the provision would effectively regulate substantial activity outside Utah’s borders.
The court said Aylo could not assure compliance without age-checking all users because even one visitor concealing a Utah location could create liability. Techdirt reported that the ruling used Aylo’s roughly 28 million monthly U.S. visitors as an illustration of that reach.
What parts of Utah’s law still apply?
Utah’s existing requirement that covered adult sites use age verification remains operative. The injunction concerns the added actual-location rule, not the broader statute, and the court has not finally resolved Aylo’s challenge.
SB 73 also restricts covered websites from providing information or instructions on using a VPN to bypass age checks. That separate restriction was not challenged in Aylo’s lawsuit, EFF said.
Before the ruling, Utah and Aylo had agreed that the state would not enforce the new VPN-related law against Aylo while the court considered the injunction request or while compliance rules were being finalized, according to EFF. The Utah Department of Commerce published proposed rules on Sept. 1; EFF said the injunction prevents enforcement of the blocked provision pending further court action.
The attorney general’s office argued that the statute called for reasonable efforts rather than flawless geolocation, Gizmodo reported. Barlow rejected that reading at this stage, writing that the court had to assess the language enacted by the Legislature rather than an enforcement approach proposed by the attorney general.
This story draws on original reporting from Techdirt.