The strongest case for Utah's approach
Utah's argument deserves a fair hearing first. Age verification for adult sites is now constitutionally settled ground: in Free Speech Coalition v. Paxton (2025), the Supreme Court upheld Texas's age-verification law under intermediate scrutiny. Lawmakers who follow that decision reasonably worry that a check is trivially defeated if a teenager can connect through a VPN. Utah's logic is internally consistent. If the law protects children only when it cannot be bypassed, then VPN traffic has to be covered.
The problem is what that logic demands of a website operator.
What SB 73 did and what the court found
SB 73, the "Online Age Verification Amendments," was enrolled in the 2026 session and took effect May 6, 2026. The enrolled text requires a commercial entity whose site contains a substantial portion of material harmful to minors to perform reasonable age verification. It also bars that entity from facilitating or encouraging the use of a VPN, proxy server or other means of circumventing verification. Per KPCW's report, the 2026 update also required verification even when a user is on a VPN, barred sharing VPN instructions, and added a 2% tax on pornography transactions.
On September 24, 2026, U.S. District Judge David Barlow granted a preliminary injunction to Aylo, the parent company of Pornhub. Per KPCW, he found that the law would require Aylo to "geolocate its website users with perfection to avoid liability," and that technology capable of perfect geolocation does not exist yet. EFF's account quotes the court calling this "a technical impossibility on pain of legal liability." It also reports that compliance would mean verifying the ages of "28 million users" located anywhere in the country, from Salt Lake City to Honolulu, and that the law likely violates the dormant Commerce Clause.
Utah's Attorney General, Derek Brown, argued the state wanted only "reasonable effort," not perfection. KPCW reports the judge answered that courts must read the statute the Legislature wrote, not the enforcement posture the state promises. That is the right instinct. A law that is harmless only because the prosecutor is generous is a law that chills lawful conduct.
Why the engineering matters to the constitutional analysis
A VPN does one thing: it makes a user's traffic appear to originate somewhere else. A site operator sees only the exit server's IP address. Commercial VPN providers rotate those addresses constantly, and residential proxy networks are built to look like ordinary home connections. No operator can reliably distinguish a Utahn tunneling through Frankfurt from a German in Frankfurt.
So the law gave a site two options. It could verify everyone, everywhere, which makes one state's rule a national mandate and is exactly the extraterritorial burden the Commerce Clause doctrine polices. Or it could block everyone who looks like a VPN user, which sweeps in journalists, abuse survivors, dissidents and ordinary people protecting their privacy on public Wi-Fi. Neither option is the "reasonable" verification the statute's own first clause describes.
Aylo's own history shows how blunt the outcome is. According to KPCW, after Utah's 2023 law took effect, Pornhub blocked the state entirely, and Google searches for VPNs spiked there. The policy goal was to keep minors away from adult content. The measurable result was more VPN adoption, not fewer minors with access. A Deseret News report adds that Aylo committed to keep geographic blocking of Utah in place while the state paused enforcement.
The speech problem in the VPN-instructions ban
The provision barring sites from sharing VPN instructions raises a separate issue. It restricts what a publisher may say, and information about a lawful privacy tool is protected speech. Paxton applied intermediate scrutiny to the age-check itself because the burden on adults' access was incidental. A rule that prohibits a category of truthful information is not incidental in that sense. Even supporters of age verification should want that line held, because it separates regulating access to content from policing the discussion of how to protect your privacy.
What this means for policymakers
The ruling is a preliminary injunction, not a final judgment, and it does not reverse Paxton. It does not say states cannot require age assurance. It says they cannot impose strict liability for an outcome that no technology can deliver. The proportionate path is available:
- Set a reasonableness standard tied to widely available geolocation signals, with a safe harbor for operators who meet it. Utah's own bill already contemplates a safe harbor tied to division standards.
- Move verification to the device or operating-system layer, where location and age signals do not depend on guessing past a VPN.
- Leave circumvention to the user's parents and platforms' safety tools, and do not criminalize or tax speech about privacy technology.
The lesson for other states drafting copycat VPN provisions is practical. Courts will read the words as written, and "perfection" is not a standard any operator can meet. Legislation that asks for proportionate effort can protect children and survive review. Legislation that asks for the impossible protects no one and invites the injunction Utah just received.