On May 13, 2026, Pornhub parent company Aylo filed a federal lawsuit asking the U.S. District Court for the District of Utah to declare Utah Senate Bill 73 unconstitutional and to enjoin its enforcement. SB 73, the "Online Age Verification Amendments" signed by Governor Spencer Cox on March 19, 2026, is the first U.S. statute that treats a website as legally responsible for the age and location of any user who reaches it via a VPN. The lawsuit targets specifically what the bill calls the "Deemed-Location Provision," which presumes a Utah user when the platform cannot verify otherwise, and creates liability of up to $2,500 per violation.

Why It Matters

Utah SB 73 is the first state law in the United States to legally route around VPN-based circumvention of age verification, and Aylo's lawsuit is the test case that will determine whether the model can spread. If Utah wins, expect copycat bills in Texas, Florida, Louisiana, Mississippi, and at least three additional states within twelve months — and a corresponding compliance reset for every covered platform, since "user is using a VPN" stops being a defense and becomes an evidentiary problem. If Aylo wins on Commerce Clause grounds, age-verification statutes broadly will face renewed scrutiny over their extraterritorial reach. Either ruling reshapes the platform side of the adult-content age-verification debate going into 2027 state legislative sessions.

The case sits at the intersection of three trends the Afterglow desk has been tracking: the post-Paxton wave of state age-verification laws, Aylo's geo-blocking response strategy (already deployed in France, the UK, and Australia), and the technical problem of VPN traffic, which an Electronic Frontier Foundation analysis last month characterized as a "technical whack-a-mole" requirement that effectively forces global age verification. Aylo's complaint argues that SB 73 violates the Dormant Commerce Clause by requiring the company to verify the age and location of users worldwide in order to identify Utah residents who mask their location, putting up to 80% of its users at risk of being routed off the platform.

The procedural posture is unusual. Most of SB 73 took effect May 6, 2026, including a 2% adult-content "sin tax" that funds mental health programs. But the Utah Department of Commerce and Aylo reached a stipulated agreement on April 27 to delay enforcement of the VPN-specific Deemed-Location Provision until September 3, 2026, while the litigation works its way through federal court. That stipulation gives both sides until early fall to develop the record, and means the merits ruling is likely to drop into the early-September news cycle alongside Congress returning from recess.

The lawsuit is being closely watched by every platform with adult content or age-restricted services, because if SB 73's VPN-aware framework survives, it gives every state a template to make platforms responsible for the technical privacy choices of their users. Digital rights groups including EFF, the Free Speech Coalition, and TechFreedom have signaled they will file amicus briefs supporting Aylo's constitutional challenge.

Sources

Update — 2026-05-14

Initial entry — story first created.

Update — 2026-08-29

The September 3 deadline just slipped to October 22. On Thursday, August 27, 2026, Aylo and the Utah Division of Consumer Protection filed a joint stipulation extending the enforcement pause on the deemed-location provision until October 22, 2026, or until the court resolves Aylo's pending preliminary injunction motion — whichever comes first. XBIZ reported the extension August 28. This is the second extension of a forbearance period that was originally set to expire September 3.

What triggered it: earlier in August, the Utah Division of Consumer Protection issued a proposed rule implementing SB 73, including criteria for what constitutes an acceptable standard for addressing "geolocation obfuscation." The rule is slated to take effect October 8, with public comment open until October 1. The new October 22 forbearance date is deliberately set two weeks past the rule's effective date, giving both the parties and the court time to absorb it.

Per the joint stipulation: "Although Plaintiffs believe that the proposed rule is fundamentally flawed and does not eliminate their claims or the need for relief, this Period of Continued Forbearance allows Plaintiffs to participate in that rulemaking process without the threat of liability in the interim. Additionally, this Period of Continued Forbearance provides the Court with additional time to resolve the current motion for a preliminary injunction, including the discretion to await the outcome of the rulemaking before deciding the motion."

The caveat for everyone who isn't Aylo: the forbearance technically applies only to Aylo-operated sites. Industry attorney Corey D. Silverstein told XBIZ that Utah would find it impractical to enforce the law against any site or company until the injunction motion is ruled upon — but emphasized that other operators should consult their own counsel, because they may still be subject to enforcement actions in the interim.

What changed since May: the case has shifted from a pure constitutional challenge to a hybrid constitutional-plus-rulemaking fight. The court now has the option to wait for Utah's implementing rule to land before ruling on the injunction, which means the substantive question — what a platform must actually do about VPN traffic to be compliant — may get answered by regulators before it gets answered by a judge. Two dates now matter more than September 3 did: October 1 (comment window closes) and October 22 (forbearance lapses).

New Sources

Update — 2026-09-01

The September 3 date is officially dead — and the new number is October 22. AVN's Michael McGrady Jr. reported on August 31, 2026 that Aylo and the State of Utah informed the federal district court on Thursday, August 27, that all parties have agreed to further delay enforcement of SB 73's VPN provisions. The forbearance period that was due to lapse September 3 now runs to October 22, 2026. Utah's consumer protection authorities are still taking public comment on how to enforce the new rules, with that window closing October 1.

Why the correction matters. Consumer-tech coverage got this wrong in real time. Gizmodo published a piece on August 31 headlined "The first US law targeting VPN use takes effect September 3," stating that the pause "expires tomorrow" — a claim that was already superseded by the joint stipulation filed four days earlier. The Gizmodo piece is a sponsored VPN-affiliate placement, which is worth noting given how much of the mainstream framing of SB 73 is now being written by parties selling the circumvention tool. Anyone tracking this statute should date-check against the docket, not the coverage.

The substance Gizmodo did get right, and which is useful context: SB 73 passed the Utah Senate 22–2 and the House 66–1 before Governor Cox signed it March 19, 2026. It applies to commercial sites where more than one third of material is deemed harmful to minors, penalties reach $2,500 per violation, and the statute additionally bars covered sites from publishing instructions on using a VPN to circumvent the age gate — a speech provision the EFF has flagged separately from the deemed-location fight. Ordinary VPN use in Utah remains legal; the liability runs to the platform, not the user. NordVPN has publicly argued the compliance model is technically unworkable, since commercial VPNs, residential proxy networks, rotating IP pools and CGNAT traffic are not reliably distinguishable from ordinary connections at scale.

Where this leaves the timeline. Utah's implementing rule — including its criteria for acceptable handling of "geolocation obfuscation" — is slated to take effect October 8. Comments close October 1. Forbearance lapses October 22, two weeks after the rule lands, unless the court rules on Aylo's preliminary injunction motion first. At least 26 other states have age-verification laws in effect or under consideration and are treating this docket as the test case for whether VPN-targeting language survives judicial review.

New Sources

Update — 2026-09-25

Aylo wins the injunction, and the court's reasoning is technical rather than purely constitutional. On September 24, 2026, U.S. District Judge David Barlow granted Aylo a preliminary injunction blocking Utah SB 73's VPN provisions — the first judicial ruling anywhere in the U.S. on VPN-aware age-verification liability. The law stays enjoined until a court rules on its constitutionality outright.

Barlow's holding turns on capability, not speech. He found the statute would require Aylo to "geolocate its website users with perfection to avoid liability," and that it is "undisputed" that technology capable of perfect geolocation does not exist — making Aylo likely to succeed on the merits and establishing irreparable harm, the two pillars of preliminary relief.

The Attorney General's "reasonable effort" argument failed on separation-of-powers grounds. Utah AG Derek Brown argued the state was not demanding perfection, only that platforms make a reasonable effort to determine whether a user sits inside Utah. Barlow rejected the distinction, writing that the court must "analyze the statutory text the Legislature passed into law, not just the Attorney General's proposed enforcement of it." That is the most portable line in the ruling: prosecutorial restraint at the enforcement stage does not cure an impossible standard written into statute.

What else was in the enjoined package. Beyond the Deemed-Location Provision, the 2026 update barred adult sites from publishing instructions for obtaining or using a VPN — a provision digital-rights advocates flagged as a direct First Amendment problem — and imposed a 2% excise tax on transactions made on pornography websites. All of it is now on hold. Because Utah had already stipulated to forbearance while the motion was pending, the practical change is durability rather than immediate relief: Pornhub remains geoblocked in Utah by Aylo's own choice, serving a warning screen, and Utah's post-2023 spike in VPN search traffic — the behavior SB 73 was drafted to close off — stands undisturbed.

Read against the week's other age-verification news, a pattern emerges. Ofcom opened a formal Online Safety Act investigation into Aylo's reliance on Apple's iOS 26.4 device-level checks on September 23, and Canada's Bill S-209, which carries an arm's-length third-party verification defence, got its first Commons hour on September 24. The regimes making forward progress are specifying how to verify. Utah legislated against the workaround instead, and the workaround turned out to rest on geolocation physics the state could not supply. At least two dozen states with age-verification laws in effect or pending will be reading this docket.

New Sources

Update — 2026-09-27

The opinion's reasoning, and the one word that decided it. Fuller reporting on Judge David Barlow's September 24 order — a 40-page opinion, per Courthouse News — clarifies exactly how Utah lost. At argument, the state's attorneys conceded it is nearly impossible to know where a person is actually accessing the internet from, and pivoted to arguing the statute only demands reasonable effort rather than perfection. They offered a workable-sounding method: cross-reference a user's time zone, browser language setting, transaction currency and historical account activity to infer location. Barlow quoted the state's own example — "a Utah-based user would be unlikely to have their time zone set to India, browser language set to Hindi, and their transaction currency set to rupees" — and then rejected the argument on textual grounds, because the provision never says "reasonable." "A holistic reading of the provisions confirms that reasonableness does not apply to the statute's geolocation requirements," Barlow wrote. "In short, Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites' users."

The scale argument that made strict liability fatal. Aylo told the court that roughly 86% of its users live outside the United States. Under strict liability for any Utah-located user, with no reliable way to identify them, the only compliant posture is to age-verify everyone on earth — which is how a state statute becomes a dormant Commerce Clause problem. Barlow's balancing was blunt: "The harm of a constitutional violation is greater than Utah's interest in enforcing a statutory provision that likely is unconstitutional." Aylo is represented by Daniel Schwei of Jenner & Block. Utah's Attorney General's office declined to comment.

A regulatory deadline died with the order. The Utah Division of Consumer Protection's implementing rule for SB 73 — including its criteria for what counts as adequately addressing "geolocation obfuscation" — had been set to take effect October 8, 2026. Thursday's injunction stops that rule from being enforced pending further order of the court.

Industry counsel read it as a drafting lesson, not a defeat for age verification. Attorney Lawrence Walters called the ruling "a reminder that states cannot solve a technology problem by writing an impossible duty into the code," and drew the boundary explicitly: after Free Speech Coalition v. Paxton, states "have more room to require age verification. However, they do not have license to export that duty to every user on Earth because some Utahns use VPNs." His guidance to legislatures — "Draft for the internet as it actually exists. Do not impose strict liability for a determination no website can make with certainty." Corey Silverstein put the appellate odds plainly: "The statutory wording is a significant obstacle... Because perfect geolocation is not possible, the court concluded that avoiding liability would effectively require age checks for users outside Utah." Utah can appeal or redraft, but any revision gets judged on its own wording and effect.

Precedential reach. Aylo is simultaneously defending an Indiana suit alleging it violated that state's age-verification law by failing to block VPN users, and the same strict-liability drafting pattern appears in other states' VPN provisions — meaning the final Utah verdict, not just this injunction, is the one other legislatures and litigants will be reading.

New Sources