TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A federal judge issued a preliminary injunction blocking enforcement of Utah SB 73’s VPN-related provisions while a lawsuit proceeds. The court found the law likely requires covered websites to determine every visitor’s location perfectly, which the judge said current geolocation tools cannot do.
A federal judge has temporarily blocked Utah from enforcing the VPN provisions of SB 73, ruling that the law likely requires adult websites to locate users with a degree of accuracy that is not technically available. The order, welcomed by the Electronic Frontier Foundation, applies while a constitutional challenge brought by Aylo, the parent company of Pornhub and other adult platforms, proceeds in court.
Utah’s SB 73 was signed into law earlier in 2026. It requires covered adult websites to either identify visitors’ physical locations and block those in Utah, or verify visitors’ ages in case they are located in the state. The VPN provisions target users whose internet traffic is routed through tools that can obscure their location. The law also bars covered sites from providing instructions on using a VPN to bypass the checks; EFF says Aylo’s lawsuit does not challenge that separate provision.
Judge Barlow’s preliminary ruling halted enforcement of the VPN provisions last week, according to EFF’s October report. The judge found that the law likely burdens people and businesses outside Utah because a website could face liability if even one visitor’s location were obscured. In the court’s words, the provision “in practice requires an entity to perform age verification services for every user visiting its site from any location.”
The court described the requirement as demanding “geolocation perfection” and said that level of accuracy is not presently possible. EFF explained that a website receiving traffic through a VPN typically sees the VPN server’s IP address, rather than a reliable indication of the user’s physical location. The ruling is preliminary: it blocks the specified provisions for now, but does not resolve the case on its merits.
Why Perfect Location Matters
The ruling addresses the reach and practical effects of a state internet law, not just how Utah regulates websites within its borders. Because VPN traffic can make a visitor’s location difficult to establish, the court said the law could lead sites to apply age checks more broadly than Utah users alone. That could affect users outside the state as well as the platforms expected to comply.
EFF argues that the law’s approach could push websites toward blocking VPN traffic nationwide or withdrawing access in Utah rather than risking penalties. Those are the organization’s assessment of the practical choices under the law, not a finding that every covered service has made either decision. EFF also says proposed detection methods could involve monitoring signals such as connection latency or device time zones, which it describes as unreliable and potentially intrusive.
The injunction means the challenged VPN requirements cannot be enforced while the case continues. It does not invalidate Utah’s broader age-verification law or settle the constitutionality of every provision. The court’s reasoning could matter to other states considering rules that depend on platforms identifying where internet users are connecting from.
As an affiliate, we earn on qualifying purchases.
From SB 73 to the Court Order
Aylo filed a constitutional challenge after Utah enacted SB 73, which was initially set to take effect in May 2026. The company and the state agreed to pause enforcement while the court considered a request for a preliminary injunction or until administrative rules setting compliance terms were finalized.
On September 1, Utah’s Division of Consumer Protection published proposed rules, identified as R152-78B. EFF submitted comments opposing them, arguing the rules would require websites to detect location obfuscation and could prompt broader data collection. The department’s notice said the rules could take effect as soon as October 8, 2026. The judge’s order now prevents enforcement of the law’s VPN provisions pending further court action.
EFF characterized Utah as, to its knowledge, the first state to target VPN use to avoid legally required age-verification gates. That description is the organization’s account. The court’s preliminary decision focused on the alleged burden beyond Utah and the demand for location accuracy, rather than making a final ruling on all challenges to the statute.
““Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users.””
— Judge Barlow, as quoted in EFF’s report
As an affiliate, we earn on qualifying purchases.
Limits of the Preliminary Order
The order is preliminary, and the source material does not provide the complete ruling, its full terms, or a schedule for the next court proceedings. The case has not produced a final judgment on whether SB 73 is unconstitutional. It is also not clear from the available information whether the state will appeal or how the court will address the law’s other provisions.
The practical effects of the proposed detection rules remain disputed. EFF says signals such as latency and device time zones are unreliable and could lead to misclassification and privacy harms. The supplied material does not include a response from Utah officials or the department’s position on those criticisms. Nor does it establish how individual platforms would implement the rules if they were ultimately allowed to take effect.
As an affiliate, we earn on qualifying purchases.
The Lawsuit and Rules Proceed
The Aylo lawsuit will continue, with the preliminary injunction keeping the VPN provisions unenforceable while the court considers further action. The ruling does not, on the information provided, set out the next hearing date or require a particular change to the statute.
Utah’s proposed administrative rules and EFF’s comments may remain part of the dispute over how the state intended websites to comply. The next key development will be further action by the court, including any later decision on the injunction or the underlying constitutional claims. Until then, the extent to which Utah can enforce the challenged requirements remains unsettled.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the judge block?
The judge issued a preliminary injunction blocking enforcement of SB 73’s VPN-related provisions while Aylo’s lawsuit proceeds. The ruling does not, based on the supplied report, block every part of the law.
Why did the court say the requirements may be impossible?
Websites generally see the IP address of the VPN server, not a dependable signal of the visitor’s physical location. The court said the law appears to demand perfect location detection even though perfect geolocation is not presently possible.
Does the order end Utah’s age-verification law?
No. The decision is preliminary and concerns the challenged VPN provisions. The lawsuit has not reached a final judgment, and the order does not establish that every part of SB 73 is invalid.
What happens to Utah’s proposed rules?
The state published proposed compliance rules on September 1, 2026, and EFF submitted objections. The source material says the rules could have taken effect as soon as October 8, but does not explain whether or how the injunction changes their separate administrative status.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
