On May 13, 2026, Pornhub parent company Aylo filed a federal lawsuit asking the U.S. District Court for the District of Utah to declare Utah Senate Bill 73 unconstitutional and to enjoin its enforcement. SB 73, the "Online Age Verification Amendments" signed by Governor Spencer Cox on March 19, 2026, is the first U.S. statute that treats a website as legally responsible for the age and location of any user who reaches it via a VPN. The lawsuit targets specifically what the bill calls the "Deemed-Location Provision," which presumes a Utah user when the platform cannot verify otherwise, and creates liability of up to $2,500 per violation.

Why It Matters

Utah SB 73 is the first state law in the United States to legally route around VPN-based circumvention of age verification, and Aylo's lawsuit is the test case that will determine whether the model can spread. If Utah wins, expect copycat bills in Texas, Florida, Louisiana, Mississippi, and at least three additional states within twelve months — and a corresponding compliance reset for every covered platform, since "user is using a VPN" stops being a defense and becomes an evidentiary problem. If Aylo wins on Commerce Clause grounds, age-verification statutes broadly will face renewed scrutiny over their extraterritorial reach. Either ruling reshapes the platform side of the adult-content age-verification debate going into 2027 state legislative sessions.

The case sits at the intersection of three trends the Afterglow desk has been tracking: the post-Paxton wave of state age-verification laws, Aylo's geo-blocking response strategy (already deployed in France, the UK, and Australia), and the technical problem of VPN traffic, which an Electronic Frontier Foundation analysis last month characterized as a "technical whack-a-mole" requirement that effectively forces global age verification. Aylo's complaint argues that SB 73 violates the Dormant Commerce Clause by requiring the company to verify the age and location of users worldwide in order to identify Utah residents who mask their location, putting up to 80% of its users at risk of being routed off the platform.

The procedural posture is unusual. Most of SB 73 took effect May 6, 2026, including a 2% adult-content "sin tax" that funds mental health programs. But the Utah Department of Commerce and Aylo reached a stipulated agreement on April 27 to delay enforcement of the VPN-specific Deemed-Location Provision until September 3, 2026, while the litigation works its way through federal court. That stipulation gives both sides until early fall to develop the record, and means the merits ruling is likely to drop into the early-September news cycle alongside Congress returning from recess.

The lawsuit is being closely watched by every platform with adult content or age-restricted services, because if SB 73's VPN-aware framework survives, it gives every state a template to make platforms responsible for the technical privacy choices of their users. Digital rights groups including EFF, the Free Speech Coalition, and TechFreedom have signaled they will file amicus briefs supporting Aylo's constitutional challenge.

Sources

Update — 2026-05-14

Initial entry — story first created.