A federal judge has issued a preliminary injunction blocking Utah’s SB 73, an age-verification law that attempted to regulate adult websites by requiring them to block VPN users or identify the physical location of visitors using privacy-protecting tools. The law also prohibited websites from offering instructions on how to use VPNs to bypass age-verification checks.
The Utah federal court halted enforcement of the law’s VPN provisions, ruling that it likely violates the U.S. Constitution’s prohibition on passing laws that significantly burden businesses and people outside Utah’s borders. According to the court, SB 73 would require adult websites to either know every visiting user’s physical location and block those in Utah, or verify every visitor’s age regardless of location. “The law’s actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating,” the court wrote.
The legal challenge was filed by Aylo, the parent company of major online adult platforms including Pornhub, after the law was signed into law earlier this year and was initially set to take effect in May 2026.
Judge Barlow’s ruling emphasized the fundamental technical problem: the statute requires what is currently impossible. “The statute requires perfection in the absence of perfect geolocation tools,” the judge noted, explaining that VPNs protect user privacy by routing web traffic through intermediary servers, making it impossible for destination websites to reliably determine a user’s actual location. Under the current framework, platforms would face an impossible choice: completely block all VPN traffic nationwide or withdraw access from Utah entirely.
The Electronic Frontier Foundation (EFF), which submitted comments opposing the law, highlighted that the administrative rules drafted by Utah would require “commercially reasonable geolocation obfuscation detection systems”—another technical impossibility. EFF also argued that the rules would force invasive data collection on internet users everywhere, requiring greater surveillance to detect VPN usage than the age-verification requirements themselves demand.
Utah legislators have indicated they may attempt to revise the law during the next legislative session. The preliminary injunction sets a precedent that state lawmakers cannot use age verification to force widespread tracking or undermine essential security tools, according to EFF.
Key facts
- A federal judge blocked Utah’s SB 73, which required adult websites to detect and block VPN users or identify their physical location
- The court ruled the law violates the Constitution by imposing requirements that significantly burden businesses and people outside Utah
- VPNs route traffic through intermediary servers, making it technically impossible for websites to reliably determine users’ actual locations
- The law would force platforms to either block all VPN traffic nationwide or withdraw from Utah entirely
- Utah’s proposed administrative rules required “commercially reasonable geolocation obfuscation detection systems,” which EFF argues is technically impossible