On May 13, 2026, Pornhub parent company Aylo filed a federal lawsuit asking the U.S. District Court for the District of Utah to declare Utah Senate Bill 73 unconstitutional and to enjoin its enforcement. SB 73, the "Online Age Verification Amendments" signed by Governor Spencer Cox on March 19, 2026, is the first U.S. statute that treats a website as legally responsible for the age and location of any user who reaches it via a VPN. The lawsuit targets specifically what the bill calls the "Deemed-Location Provision," which presumes a Utah user when the platform cannot verify otherwise, and creates liability of up to $2,500 per violation.

Why It Matters

Utah SB 73 is the first state law in the United States to legally route around VPN-based circumvention of age verification, and Aylo's lawsuit is the test case that will determine whether the model can spread. If Utah wins, expect copycat bills in Texas, Florida, Louisiana, Mississippi, and at least three additional states within twelve months — and a corresponding compliance reset for every covered platform, since "user is using a VPN" stops being a defense and becomes an evidentiary problem. If Aylo wins on Commerce Clause grounds, age-verification statutes broadly will face renewed scrutiny over their extraterritorial reach. Either ruling reshapes the platform side of the adult-content age-verification debate going into 2027 state legislative sessions.

The case sits at the intersection of three trends the Afterglow desk has been tracking: the post-Paxton wave of state age-verification laws, Aylo's geo-blocking response strategy (already deployed in France, the UK, and Australia), and the technical problem of VPN traffic, which an Electronic Frontier Foundation analysis last month characterized as a "technical whack-a-mole" requirement that effectively forces global age verification. Aylo's complaint argues that SB 73 violates the Dormant Commerce Clause by requiring the company to verify the age and location of users worldwide in order to identify Utah residents who mask their location, putting up to 80% of its users at risk of being routed off the platform.

The procedural posture is unusual. Most of SB 73 took effect May 6, 2026, including a 2% adult-content "sin tax" that funds mental health programs. But the Utah Department of Commerce and Aylo reached a stipulated agreement on April 27 to delay enforcement of the VPN-specific Deemed-Location Provision until September 3, 2026, while the litigation works its way through federal court. That stipulation gives both sides until early fall to develop the record, and means the merits ruling is likely to drop into the early-September news cycle alongside Congress returning from recess.

The lawsuit is being closely watched by every platform with adult content or age-restricted services, because if SB 73's VPN-aware framework survives, it gives every state a template to make platforms responsible for the technical privacy choices of their users. Digital rights groups including EFF, the Free Speech Coalition, and TechFreedom have signaled they will file amicus briefs supporting Aylo's constitutional challenge.

Sources

Update — 2026-05-14

Initial entry — story first created.

Update — 2026-08-29

The September 3 deadline just slipped to October 22. On Thursday, August 27, 2026, Aylo and the Utah Division of Consumer Protection filed a joint stipulation extending the enforcement pause on the deemed-location provision until October 22, 2026, or until the court resolves Aylo's pending preliminary injunction motion — whichever comes first. XBIZ reported the extension August 28. This is the second extension of a forbearance period that was originally set to expire September 3.

What triggered it: earlier in August, the Utah Division of Consumer Protection issued a proposed rule implementing SB 73, including criteria for what constitutes an acceptable standard for addressing "geolocation obfuscation." The rule is slated to take effect October 8, with public comment open until October 1. The new October 22 forbearance date is deliberately set two weeks past the rule's effective date, giving both the parties and the court time to absorb it.

Per the joint stipulation: "Although Plaintiffs believe that the proposed rule is fundamentally flawed and does not eliminate their claims or the need for relief, this Period of Continued Forbearance allows Plaintiffs to participate in that rulemaking process without the threat of liability in the interim. Additionally, this Period of Continued Forbearance provides the Court with additional time to resolve the current motion for a preliminary injunction, including the discretion to await the outcome of the rulemaking before deciding the motion."

The caveat for everyone who isn't Aylo: the forbearance technically applies only to Aylo-operated sites. Industry attorney Corey D. Silverstein told XBIZ that Utah would find it impractical to enforce the law against any site or company until the injunction motion is ruled upon — but emphasized that other operators should consult their own counsel, because they may still be subject to enforcement actions in the interim.

What changed since May: the case has shifted from a pure constitutional challenge to a hybrid constitutional-plus-rulemaking fight. The court now has the option to wait for Utah's implementing rule to land before ruling on the injunction, which means the substantive question — what a platform must actually do about VPN traffic to be compliant — may get answered by regulators before it gets answered by a judge. Two dates now matter more than September 3 did: October 1 (comment window closes) and October 22 (forbearance lapses).

New Sources

Update — 2026-09-01

The September 3 date is officially dead — and the new number is October 22. AVN's Michael McGrady Jr. reported on August 31, 2026 that Aylo and the State of Utah informed the federal district court on Thursday, August 27, that all parties have agreed to further delay enforcement of SB 73's VPN provisions. The forbearance period that was due to lapse September 3 now runs to October 22, 2026. Utah's consumer protection authorities are still taking public comment on how to enforce the new rules, with that window closing October 1.

Why the correction matters. Consumer-tech coverage got this wrong in real time. Gizmodo published a piece on August 31 headlined "The first US law targeting VPN use takes effect September 3," stating that the pause "expires tomorrow" — a claim that was already superseded by the joint stipulation filed four days earlier. The Gizmodo piece is a sponsored VPN-affiliate placement, which is worth noting given how much of the mainstream framing of SB 73 is now being written by parties selling the circumvention tool. Anyone tracking this statute should date-check against the docket, not the coverage.

The substance Gizmodo did get right, and which is useful context: SB 73 passed the Utah Senate 22–2 and the House 66–1 before Governor Cox signed it March 19, 2026. It applies to commercial sites where more than one third of material is deemed harmful to minors, penalties reach $2,500 per violation, and the statute additionally bars covered sites from publishing instructions on using a VPN to circumvent the age gate — a speech provision the EFF has flagged separately from the deemed-location fight. Ordinary VPN use in Utah remains legal; the liability runs to the platform, not the user. NordVPN has publicly argued the compliance model is technically unworkable, since commercial VPNs, residential proxy networks, rotating IP pools and CGNAT traffic are not reliably distinguishable from ordinary connections at scale.

Where this leaves the timeline. Utah's implementing rule — including its criteria for acceptable handling of "geolocation obfuscation" — is slated to take effect October 8. Comments close October 1. Forbearance lapses October 22, two weeks after the rule lands, unless the court rules on Aylo's preliminary injunction motion first. At least 26 other states have age-verification laws in effect or under consideration and are treating this docket as the test case for whether VPN-targeting language survives judicial review.

New Sources