On September 3, 2026, Utah's SB 73 — the first US law to explicitly write VPN use into an age-verification mandate — finally took effect after months of injunction, and then went nowhere. Within hours of the law becoming live, the Utah Department of Commerce agreed not to enforce it while a federal judge weighs a challenge brought by Aylo, the parent company of Pornhub. Fox 13 News reported that at a hearing the same Thursday, the judge said he could not commit to when he would issue a ruling. The result is a statute that is technically in force, functionally dormant, and legally undecided.

Why It Matters

This is the first time a state has tried to legislate around the circumvention layer rather than the content layer, and the industry's objection is not that the goal is wrong but that the compliance target does not exist. If Utah's language survives, the same provision will appear in a dozen legislatures within a session, and every adult platform will face liability for a detection problem no one has solved at scale — which realistically means age-gating all global traffic or blanket-blocking VPN ranges, both of which impose costs on users with nothing to do with adult content. If it is struck down, the anti-circumvention model loses its lead case and states fall back on geo-blocking regimes that Pornhub already answers by leaving. For operators, the immediate practical read is that nothing changes today: Utah is not enforcing, and the previous age-verification posture holds. The longer read is that the fight has moved from "must you card users" (largely settled by *FSC v. Paxton*) to "are you responsible for users who route around the card reader." That second question has no clean technical answer, which is exactly why it will be litigated for a while. Related: the federal SCREEN Act contains a parallel VPN provision, so a Utah ruling will be read closely in Senate Commerce.

SB 73, formally titled the "Online Age Verification Amendments," was signed by Governor Spencer Cox on March 19, 2026 after passing the state Senate 22-2 and the House 66-1, per Gizmodo. It applies to commercial sites where more than one third of the content is deemed harmful to minors, and its novel provision is jurisdictional: anyone physically located in Utah is treated as a Utah user regardless of the IP address they present. A Salt Lake City resident routing through a server in Germany is still, in the eyes of the statute, a Utah user, and the site they visit remains liable for verifying their age. Sites are also barred from publishing instructions on how to use a VPN to get around the age gate. Penalties reach $2,500 per violation.

Aylo's core argument in its April federal filing is technical rather than ideological. As quoted by East Idaho News, the company argued "there's no feasible way for a private company like Aylo to reliably verify whether any particular individual is using a virtual private network (VPN), proxy server, or other location-masking technology — and therefore no way to determine whether a user who appears to be located outside Utah is, in fact, located inside Utah." Commercial VPNs, residential proxy pools, rotating IPs and CGNAT connections all present traffic that looks ordinary to a website. Blocking everything proxy-shaped sweeps up corporate networks and mobile hotspots alongside teenagers.

The Electronic Frontier Foundation warned in April, as cited by Engadget, that the compliance math pushes in one direction: "If a website cannot reliably detect a VPN user's true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally." That is the practical stake — a state-level statute whose only workable compliance path is a global identity check. Pornhub has blocked access in 25 states rather than comply with age-verification regimes, and Utah is currently among them.

Utah has been the country's age-verification proving ground since 2023, when it became the first state to require age checks on adult sites. That law produced a measurable surge in Utah VPN usage; SB 73 is the legislative response to the workaround. Gizmodo notes that at least 26 other states have age-verification laws in effect or under active consideration, and legal analysts are treating SB 73 as the test case for whether VPN-targeting language survives judicial scrutiny.

Sources

Update — 2026-09-05

{Initial entry — story first created.}

Update — 2026-09-07

The pause now has a date on it. XBIZ reports that the parties agreed on August 27 to extend the "period of forbearance" — the standstill under which Utah's Division of Consumer Protection will not enforce the deemed-location provision against Aylo — until October 22, 2026. That is not an arbitrary date: the Division issued a proposed rule implementing SB 73 earlier in August, including criteria for what constitutes an acceptable standard for addressing "geolocation obfuscation," and that rule is scheduled to take effect October 8. The forbearance runs two weeks past it.

That sequencing is the thing to watch. Rather than waiting for the court, Utah is building the compliance standard administratively — defining, by rule, what a site must do about VPN and proxy traffic to be considered compliant. If the rule lands October 8 and the forbearance lapses October 22 without a ruling from the judge, operators face a live enforcement regime with a defined technical standard, regardless of how the constitutional question resolves later.

One clarification on scope, per industry attorney Corey Silverstein: the forbearance technically applies only to sites operated by Aylo, though Silverstein noted Utah would find it impractical to enforce against any site or company while the preliminary injunction motion is pending. He emphasised that companies should still consult their own counsel, as they may remain subject to enforcement actions. In other words, the widely-reported "Utah isn't enforcing" framing is a practical read, not a legal guarantee for non-Aylo operators.

Aylo's April complaint also raises arguments beyond the technical-feasibility point already covered: it contends the deemed-location provision constitutes "impermissible extraterritorial legislation" by projecting Utah's policy choices onto conduct occurring entirely outside its borders, and that the law violates the dormant Commerce Clause and Foreign Commerce Clause by burdening national and international markets for adult entertainment.

New Sources

Update — 2026-09-28

Enjoined. On September 24, 2026, U.S. District Judge David Barlow granted Aylo's motion for a preliminary injunction, blocking Utah from enforcing SB 73's deemed-location provision in a 40-page opinion. The forbearance-until-October-22 timeline covered in the last update is now moot — the provision is judicially blocked pending a ruling on its constitutionality.

Barlow's reasoning lands exactly where Aylo aimed it. The statute, he found, would require the company to "geolocate its website users with perfection to avoid liability," and it is "undisputed" that technology capable of perfect geolocation does not exist. Per Courthouse News, he wrote that "a holistic reading of the provisions confirms that reasonableness does not apply to the statute's geolocation requirements" and concluded: "In short, Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites' users." On the balance of harms: "The harm of a constitutional violation is greater than Utah's interest in enforcing a statutory provision that likely is unconstitutional."

Utah's defense was that the law demands only a reasonable effort, not perfection. Attorney General Derek Brown's office argued sites could cross-reference time zone, browser language, currency preference and historical account activity to make an educated guess — Barlow quoted the state's own example, that "a Utah-based user would be unlikely to have their time zone set to India, browser language set to Hindi, and their transaction currency set to rupees." The problem was textual, not technical: the word "reasonable" does not appear in the location provision. As Barlow put it, the court must "analyze the statutory text the Legislature passed into law, not just the Attorney General's proposed enforcement of it." A drafting omission, not a policy defeat — which means the next version of this statute in any legislature will almost certainly carry a reasonableness qualifier.

Aylo, represented by Daniel Schwei of Jenner and Block, told Courthouse News it supports age restrictions but does not think Utah's law protects user privacy: "We are pleased with the court's ruling and appreciate its careful consideration of the issues. We remain committed to complying with applicable law while safeguarding user privacy and security." The Utah Attorney General's Office declined to comment. Aylo continues to block Utah traffic to Pornhub, YouPorn and RedTube entirely, so nothing changes for Utah users today — the ruling protects the company from liability, not access.

Two adjacent pieces of SB 73 were not the subject of this ruling and remain on the books: the ban on adult sites publishing VPN instructions, which digital-rights groups have flagged as a First Amendment problem in its own right, and the 2% tax on transactions at pornography websites. The anti-circumvention model now has its first appellate-bound test case, and the lesson other states will take from it is about statutory drafting rather than whether the approach is viable at all.

New Sources

Update — 2026-10-14

Parked until the legislature fixes the wording. On October 13, 2026, XBIZ and FOX 13 reported that Judge David Barlow granted a joint motion from Aylo and the State of Utah to stay Aylo's lawsuit over SB 73's "deemed-location" (VPN) provision until the end of Utah's 2027 general session (scheduled for January 19 to March 5, 2027). The parties' filing says that, after the September preliminary injunction, they "anticipate that the Utah Legislature may consider amending the statute," and that it would be more efficient to see "what, if any, amendments the Legislature makes" than to keep litigating the current text.

Effect: the September 24 preliminary injunction stays in force, so Utah still cannot enforce the VPN provision. Aylo still blocks Utah IPs for Pornhub, YouPorn and RedTube, as it has for some time. As our last update predicted, the next step is a redraft rather than an appeal. The fix most likely to come back is a "reasonable effort" standard for geolocation, which Barlow found missing from the statute. The 2% adult-site tax and the ban on publishing VPN instructions were not part of this ruling and remain in effect.

Spillover: XBIZ reports Aylo has already cited the Utah injunction in a brief to the Marion Superior Court seeking dismissal of Indiana's suit, which alleges Aylo broke Indiana's age-verification law by not stopping VPN users. Utah's drafting mistake has become Aylo's argument in other states. Watch the 2027 Utah bill text: whatever reasonableness standard it adopts is likely to become the model other states copy.

New Sources