Utah Tried to Make Sites See Through VPNs. A Judge Said the Law Can’t Do That

A federal judge in Utah has frozen the state’s most aggressive attempt yet to police adult websites: a rule that treated anyone physically inside Utah as a Utah user, even if they were routing traffic through a VPN, a proxy, or any other tool that hid their location. The rest of the age-verification statute still stands. This piece does not.

On Sept. 24, U.S. District Judge David Barlow granted a preliminary injunction blocking Utah Code section 78B-3-1002(3), the so-called actual-location provision. Gizmodo reported that Barlow found Aylo, the parent company of Pornhub, was likely to succeed on its claim that the provision violates the Constitution’s dormant Commerce Clause. The law, he wrote, would force companies to “geolocate its website users with perfection to avoid liability.” Perfect geolocation does not exist. The parties agreed on that point. Barlow treated it as decisive.

Utah had already promised not to enforce the clause against Aylo while the motion sat with the court. The injunction converts that pause into a court order. Defendants and anyone acting with them cannot enforce the actual-location provision until the court says otherwise. Nothing in the order stops the state from enforcing the rest of Utah Code sections 78B-3-1001 to 1008.

This fight did not start in 2026. Utah has required commercial adult sites to use age-verification systems since 2023. Rather than collect IDs from Utah visitors, several large platforms, including Pornhub, simply blocked the state. Users who wanted in turned to VPNs. Search interest in those tools spiked. Lawmakers noticed. Senate Bill 73, the Online Age Verification Amendments, signed by Gov. Spencer Cox on March 19, tried to close that gap. An individual, the new text said, “is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location.” Sites were also barred from publishing instructions on how to use a VPN to get around the gates. A 2% tax on adult-content transactions was layered on top, set to take effect later in the year.

Aylo sued in April, weeks before the May 6 effective date. The company argued that because no website can know every visitor’s true physical location with certainty, the only way to avoid liability would be to age-verify users everywhere, or to shut out known VPN addresses worldwide. Either choice would export a Utah rule onto interstate and foreign commerce. KUER reported that Barlow agreed the company had shown irreparable harm and a likelihood of success. It is “undisputed,” he said, that technology capable of perfect geolocation does not exist yet.

Utah Attorney General Derek Brown’s office countered that the statute does not demand perfection. It demands reasonable efforts. Time zones, language settings, currency preferences, account history: those signals, the state said, can narrow the guess. A Utah user is unlikely to have a Hindi browser, an India time zone, and rupees as a default. Barlow was not persuaded. The court, he wrote, has to “analyze the statutory text the Legislature passed into law, not just the Attorney General’s proposed enforcement of it.” The provision as written contains no reasonableness qualifier. Fox 13 quoted him directly: “In short, Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users.”

Not reasonable efforts. Perfection. Or liability.

The Statute Demanded Perfection. Technology Can’t Deliver It.

IP-based geolocation was always an inference, not a fact. VPN and proxy lists are never complete. Corporate networks, mobile carriers, and privacy browsers throw off the same signals as a consumer VPN. The Electronic Frontier Foundation warned months before the injunction that holding companies liable for Utah users on VPNs was technically unrealistic. Sites would be pushed, the group said, to “ban all known VPN IPs, or to mandate age verification for every visitor globally.” Rindala Alajaji, EFF’s associate director of state affairs, told KUER in May that even a well-intentioned operator would find compliance nearly impossible. “Even if you’re well-intentioned and want to comply with this law, it’s nearly impossible to do so.”

That is the core of Barlow’s Commerce Clause analysis, as laid out in a 40-page opinion discussed by Biometric Update. The actual-location rule significantly altered the reach of the 2023 law. Before the amendment, Aylo complied by blocking known Utah IP addresses on its free sites. After it, the company faced exposure for any physically present Utahns who slipped through. Barlow rejected a separate Aylo argument that the provision was unconstitutional merely because it had effects beyond Utah. He did find that the burden on interstate commerce was excessive, because websites cannot determine every user’s physical location with certainty. The harm of a likely constitutional violation, he wrote, outweighed Utah’s interest in enforcing a provision that probably cannot stand.

And the text, not the press conference, is what counts. The state’s lawyers could promise a gentle hand. The Legislature did not write a gentle statute. XBIZ published the order’s operative language: defendants shall not enforce section 78B-3-1002(3) until further order of the court. The Free Speech Coalition’s board chair, Jeffrey Douglas, called the result “a significant early victory against an invasive, technologically unsound law,” and thanked Aylo for bringing the suit “when no one else would,” according to the Free Speech Coalition.

Adult sites, the coalition stressed, still have to comply with the rest of Utah’s age-verification regime. Pornhub’s Utah block remains in place as a business choice, not a court mandate. The injunction is preliminary. The case continues. Aylo and the attorney general’s office did not immediately comment after the ruling, Gizmodo noted.

So the provision sits on ice. The rest of the machine keeps running.

What the Injunction Leaves Standing

Utah’s 2023 age-verification requirement is not enjoined. Sites that carry a substantial portion of material harmful to minors, generally more than one-third of their content, must still use reasonable age-verification methods for users they can identify as being in Utah. Digitized IDs. Third-party age-verification services. Other commercially reasonable methods. Civil penalties remain on the books. The 2% tax on qualifying transactions was not the subject of this order. The ban on sites providing VPN how-to instructions was not the provision Barlow blocked, though digital-rights groups have flagged it as a First Amendment problem of its own.

That split matters. Lawmakers can still argue they are protecting minors. Platforms can still argue that a state cannot conscript the entire internet into a location-finding exercise it cannot perform. KSL reported that Aylo’s complaint warned the law would allow Utah to hold the company liable if even a single user slipped through. Barlow’s “strict liability” language tracks that fear. The state had already agreed last month to pause enforcement of the location rule while the injunction motion was pending, with Aylo keeping its Utah geofencing in place. The order now binds the state more tightly than a stipulation ever could.

But a preliminary injunction is not a final judgment. Utah can appeal. The attorney general can try to persuade a higher court that “reasonable efforts” is a fair reading of a statute that never used those words. Rulemaking at the Division of Consumer Protection, which had been moving toward standards on geolocation obfuscation, now collides with a federal bar on the actual-location clause itself. Proposed rules that assumed the clause was live will have to be rewritten or shelved.

The practical result for Utahns is simpler. They can keep using VPNs. Sites are not, for now, legally required to treat a Salt Lake City resident on a German server as a Utah visitor they must age-check or else. The 2023 framework still applies to traffic the sites can actually geolocate. The workaround that prompted SB 73 is, again, available.

Impossible, in other words, was the legal standard. The court declined to pretend otherwise.

A Ruling Other States Can’t Ignore

Dozens of U.S. states have passed some form of age verification for online pornography in the past few years. Utah was first to write VPN use directly into the liability rule. Wisconsin advocates had already forced similar language out of a bill on constitutional and technical grounds. Utah proceeded anyway. Barlow’s order is the first federal court response to that experiment, and it arrived on a dormant Commerce Clause theory rather than a pure First Amendment one. That choice will travel. States that copy Utah’s actual-location language now have a district-court opinion telling them the copy is likely unconstitutional because it cannot be performed without regulating users far outside their borders.

TechRadar, in a Sept. 28 account, quoted Gytis Malinauskas, head of legal at Surfshark, who had warned earlier that the law treated a standard security tool as an illegitimate workaround. “VPNs are a standard security tool millions of Americans use every day to protect their data. Blocking them would only erode the privacy of ordinary users.” A Proton spokesman told the same publication the company was encouraged to see the court block the actual-location provision and recognize VPNs as a critical security tool. “Although the Utah legislature has a good intention to protect children from adult content, VPNs should not be used as a scapegoat. We hope that other states will take notice and draft their child safety bills in a targeted way that does not sacrifice user privacy and security.”

Those comments sit beside a harder industrial fact. Age-verification vendors have long argued that IP addresses are only one clue, and that circumvention can be addressed without banning VPNs. Barlow did not decide whether clever heuristics could ever be “reasonable.” He decided that this statute did not ask for reasonable. It asked for actual location, regardless of disguise. A liability trap, NordVPN had called it before the ruling. The judge’s strict-liability line is that trap, named in a judicial order.

Child-protection statutes and encrypted networking were always going to collide. Utah forced the collision by writing physical presence into a law that websites can only see through IP addresses and whatever extra signals a browser happens to leak. Barlow refused to let the attorney general’s enforcement memo rewrite the code. And he refused to make a global company age-gate the planet to satisfy one state’s definition of “actually located.”

The broader age-verification fight is not over in Utah or anywhere else. Pornhub is still dark in the state. The 2023 law still has teeth. The tax is still on the calendar. What is over, for now, is the idea that a legislature can declare VPN users to be local and then punish any site that fails to prove they aren’t. The internet does not offer that proof. The Constitution, Barlow held, does not let Utah pretend it does.