Aylo, the parent company of Pornhub, filed a federal lawsuit in May 2026 challenging what may be the most technically audacious age-verification law ever enacted in the United States. Utah's Senate Bill 73, signed by Governor Spencer Cox on March 19, 2026, is the first US law to hold adult websites legally liable when Utah residents use VPNs to bypass age-verification gates. The state agreed to suspend enforcement of that specific provision until September 3, 2026 while litigation proceeds. What federal courts decide before that deadline will matter well beyond Salt Lake City.
What SB 73 Actually Does
SB 73 builds on Utah's existing age-verification framework but goes materially further than any prior state law. The statute applies to any commercial platform where more than one-third of content qualifies as "harmful to minors." Those platforms must verify user age — a baseline obligation now settled after the Supreme Court's 6-3 ruling in Free Speech Coalition v. Paxton (June 27, 2025), which upheld Texas's equivalent mandate under intermediate scrutiny.
The genuinely novel element in SB 73 is what Aylo calls the "Deemed-Location Provision." Under it, a user physically in Utah is deemed to access a website from Utah "regardless of whether they use a VPN, proxy server, or other means to disguise their geographic location." Platforms therefore cannot rely on IP-based geolocation to determine their compliance obligations. If a Utah resident routes traffic through a London VPN exit node and visits an adult site, the site remains legally liable in Utah — exposed to fines of up to $2,500 per violation. The law also prohibits affected platforms from "facilitating or encouraging" VPN circumvention, a clause the Electronic Frontier Foundation reads as barring platforms from even publishing accurate, factual information about how VPN technology works.
The Case for the Law
Utah's argument deserves a fair reading. Age-verification mandates have consistently been routed around the moment they take effect. When Pornhub blocked Texas IP addresses following that state's 2024 law, VPN demand in Texas surged approximately 235% in a single day. Senator Calvin Musselman, SB 73's sponsor, frames the VPN provision as a logical extension of the "reasonable steps" standard already applied in gambling, alcohol, and tobacco age-gating. The Age Verification Providers Association's Iain Corby articulated the argument pointedly: if platforms genuinely want to keep minors off their services, why object to verifying users by identity rather than by IP address?
That is the strongest version of the pro-compliance case, and it has real force. IP-blocking was always more theater than protection.
Why the Technical Reality Breaks the Law
The problem is that SB 73 imposes liability for a condition platforms cannot reliably detect. VPN detection is a continuous arms race: commercial providers — especially those using residential proxies or obfuscated protocols — are engineered specifically to resist fingerprinting. The EFF's Rindala Alajaji described the compliance challenge directly: "You could be based in Utah using a VPN, and it says that your IP address is in the UK — it's a technical game of whack-a-mole." NordVPN characterized SB 73 as "an unresolvable compliance paradox."
That paradox translates into strict liability for something no platform can currently guarantee. The only technically defensible path to full compliance is requiring age verification from every visitor globally — which is precisely what Aylo argues the law effectively mandates, and what the Dormant Commerce Clause is designed to block.
Three Constitutional Fault Lines
Aylo's challenge presses three distinct constitutional claims, each of which survived prior age-verification litigation and each of which is strengthened by the VPN-specific provisions.
First Amendment overbreadth. The prohibition on "facilitating or encouraging" VPN use bars platforms from sharing truthful information about a lawful, widely used privacy tool. The government cannot suppress speech about a lawful product simply because that speech could enable regulatory avoidance — that is, itself, a speech restriction requiring justification.
Dormant Commerce Clause. Because reliable VPN detection does not exist, the practical compliance path for any global platform is worldwide age-gating of all users — not just Utahns. Aylo argues this converts a state-level regulation into a de facto global mandate, fragmenting national internet infrastructure across incompatible state requirements. Aylo estimates losing approximately 80% of out-of-state customers who would switch to non-verifying competitors rather than submit identification. Courts have struck state regulations on this basis when extraterritorial effects are sufficiently severe.
Due process. SB 73 holds platforms strictly liable for user conduct — choosing to use a VPN — entirely outside the platform's control. Good-faith compliance efforts cannot close a detection gap that is technically unbridgeable. Imposing liability without any causal nexus to platform behavior is the kind of strict-liability regime courts scrutinize carefully.
The Privacy Paradox States Are Ignoring
There is an irony Utah's sponsors have not resolved. Every credible age-verification system requires collecting government-grade identity data from users, creating databases that link browsing habits to real names. Mandating VPN detection amplifies this problem: platforms must now invest in traffic surveillance infrastructure rather than in privacy-preserving verification architectures. Multiple age-assurance technologies already exist that can confirm a user is an adult without retaining their identity. Utah's law neither requires nor incentivizes them. A regulation designed around technical reality would specify outcome-based standards — confirm age, do not retain identity — rather than mandating detection of a specific evasion technique.
What the Litigation Will Settle
The September 3 enforcement deadline is real. If Aylo does not secure a preliminary injunction, it faces a binary choice: block all traffic from apparent VPN users — a significant and growing share of the privacy-conscious internet — or absorb per-violation liability for every Utah resident who slips through undetected.
The precedential stakes are national. More than 20 states enacted age-verification frameworks after Paxton. If Utah's VPN liability clause survives, similar provisions will proliferate quickly — and every major adult platform will face the same impossible compliance calculus. If federal courts strike it on Commerce Clause or due process grounds, that ruling will constrain the age-verification wave in ways Paxton did not anticipate.
Effective child protection online is worth pursuing and technically achievable. It requires privacy-preserving age assurance, federal preemption to prevent incompatible state mandates, and honest accounting of what detection technology can actually deliver. Utah's SB 73, by mandating an outcome nobody can technically guarantee, burdens adult speech without reliably protecting minors — precisely the combination proportionate regulation should avoid.