On September 3, 2026, Utah's SB 73 — the first US law to explicitly write VPN use into an age-verification mandate — finally took effect after months of injunction, and then went nowhere. Within hours of the law becoming live, the Utah Department of Commerce agreed not to enforce it while a federal judge weighs a challenge brought by Aylo, the parent company of Pornhub. Fox 13 News reported that at a hearing the same Thursday, the judge said he could not commit to when he would issue a ruling. The result is a statute that is technically in force, functionally dormant, and legally undecided.

Why It Matters

This is the first time a state has tried to legislate around the circumvention layer rather than the content layer, and the industry's objection is not that the goal is wrong but that the compliance target does not exist. If Utah's language survives, the same provision will appear in a dozen legislatures within a session, and every adult platform will face liability for a detection problem no one has solved at scale — which realistically means age-gating all global traffic or blanket-blocking VPN ranges, both of which impose costs on users with nothing to do with adult content. If it is struck down, the anti-circumvention model loses its lead case and states fall back on geo-blocking regimes that Pornhub already answers by leaving. For operators, the immediate practical read is that nothing changes today: Utah is not enforcing, and the previous age-verification posture holds. The longer read is that the fight has moved from "must you card users" (largely settled by *FSC v. Paxton*) to "are you responsible for users who route around the card reader." That second question has no clean technical answer, which is exactly why it will be litigated for a while. Related: the federal SCREEN Act contains a parallel VPN provision, so a Utah ruling will be read closely in Senate Commerce.

SB 73, formally titled the "Online Age Verification Amendments," was signed by Governor Spencer Cox on March 19, 2026 after passing the state Senate 22-2 and the House 66-1, per Gizmodo. It applies to commercial sites where more than one third of the content is deemed harmful to minors, and its novel provision is jurisdictional: anyone physically located in Utah is treated as a Utah user regardless of the IP address they present. A Salt Lake City resident routing through a server in Germany is still, in the eyes of the statute, a Utah user, and the site they visit remains liable for verifying their age. Sites are also barred from publishing instructions on how to use a VPN to get around the age gate. Penalties reach $2,500 per violation.

Aylo's core argument in its April federal filing is technical rather than ideological. As quoted by East Idaho News, the company argued "there's no feasible way for a private company like Aylo to reliably verify whether any particular individual is using a virtual private network (VPN), proxy server, or other location-masking technology — and therefore no way to determine whether a user who appears to be located outside Utah is, in fact, located inside Utah." Commercial VPNs, residential proxy pools, rotating IPs and CGNAT connections all present traffic that looks ordinary to a website. Blocking everything proxy-shaped sweeps up corporate networks and mobile hotspots alongside teenagers.

The Electronic Frontier Foundation warned in April, as cited by Engadget, that the compliance math pushes in one direction: "If a website cannot reliably detect a VPN user's true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally." That is the practical stake — a state-level statute whose only workable compliance path is a global identity check. Pornhub has blocked access in 25 states rather than comply with age-verification regimes, and Utah is currently among them.

Utah has been the country's age-verification proving ground since 2023, when it became the first state to require age checks on adult sites. That law produced a measurable surge in Utah VPN usage; SB 73 is the legislative response to the workaround. Gizmodo notes that at least 26 other states have age-verification laws in effect or under active consideration, and legal analysts are treating SB 73 as the test case for whether VPN-targeting language survives judicial scrutiny.

Sources

Update — 2026-09-05

{Initial entry — story first created.}

Update — 2026-09-07

The pause now has a date on it. XBIZ reports that the parties agreed on August 27 to extend the "period of forbearance" — the standstill under which Utah's Division of Consumer Protection will not enforce the deemed-location provision against Aylo — until October 22, 2026. That is not an arbitrary date: the Division issued a proposed rule implementing SB 73 earlier in August, including criteria for what constitutes an acceptable standard for addressing "geolocation obfuscation," and that rule is scheduled to take effect October 8. The forbearance runs two weeks past it.

That sequencing is the thing to watch. Rather than waiting for the court, Utah is building the compliance standard administratively — defining, by rule, what a site must do about VPN and proxy traffic to be considered compliant. If the rule lands October 8 and the forbearance lapses October 22 without a ruling from the judge, operators face a live enforcement regime with a defined technical standard, regardless of how the constitutional question resolves later.

One clarification on scope, per industry attorney Corey Silverstein: the forbearance technically applies only to sites operated by Aylo, though Silverstein noted Utah would find it impractical to enforce against any site or company while the preliminary injunction motion is pending. He emphasised that companies should still consult their own counsel, as they may remain subject to enforcement actions. In other words, the widely-reported "Utah isn't enforcing" framing is a practical read, not a legal guarantee for non-Aylo operators.

Aylo's April complaint also raises arguments beyond the technical-feasibility point already covered: it contends the deemed-location provision constitutes "impermissible extraterritorial legislation" by projecting Utah's policy choices onto conduct occurring entirely outside its borders, and that the law violates the dormant Commerce Clause and Foreign Commerce Clause by burdening national and international markets for adult entertainment.

New Sources