On September 24, 2026, U.S. District Judge David Barlow granted a preliminary injunction in Aylo Freesites v. Utah Division of Consumer Protection. It blocks the VPN provision of Utah's 2026 Online Age Verification Amendments (SB 73). The ruling does not touch age verification itself. It addresses a narrower question: can a state make a website liable for users it cannot reliably locate?
The strongest case for Utah
Utah's argument deserves a fair statement. Age-verification laws are only as strong as their weakest workaround. If a teenager in Salt Lake City can switch on a VPN and appear to be in another state, the 2023 mandate protects no one. Legislators who want the law to mean something have a rational interest in closing that gap. The Supreme Court has also made the underlying policy easier to defend. In Free Speech Coalition v. Paxton, decided June 27, 2025, the Court affirmed the Fifth Circuit in a decision written by Justice Thomas and joined by five other justices, with three dissenting (Supreme Court docket). In effect, it held that adult-site age verification can survive First Amendment review.
The VPN ruling does not contradict that. The Constitution has more than one limit, and this case turned on a different one.
What the provision did and why it failed
According to Gizmodo's report, the amendments took effect in May and updated Utah's 2023 age-verification law. The blocked provision said a person accesses a site from Utah if they are "physically located in the state, regardless of whether they use a VPN or any other method to hide their location." EFF's account adds that the law required adult sites either to block VPN users or to identify visitors' physical locations, and it barred sites from giving VPN usage instructions.
The key word is "regardless." The statute defines the user by true physical location, which a website cannot observe. A site sees an IP address. When that address belongs to a VPN exit node, the site learns nothing reliable about where the person sits.
Judge Barlow found that Aylo was likely to succeed on a dormant Commerce Clause claim. That doctrine limits states from imposing excessive burdens on interstate commerce. Gizmodo reports his conclusion that the law requires companies to "geolocate its website users with perfection to avoid liability." Per EFF's quotation of the opinion, the statute "essentially imposes strict liability" on sites for determining where users are. Because no perfect geolocation tool exists, Aylo would need to verify about 28 million users, "whether located in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu." The opinion itself was posted by Courthouse News.
Gizmodo also notes that Barlow looked at "the statutory text the Legislature passed into law, not just the Attorney General's proposed enforcement of it." That point matters. Utah officials can promise reasonable enforcement, but a court reviewing a statute must assume it will be applied as written.
The extraterritoriality problem
The ruling shows why this is a structural flaw and not a drafting slip. To avoid strict liability for any VPN user who might be in Utah, a site has two options. It can verify everyone, including users in Boston or Honolulu who have no connection to Utah. Or it can block VPN traffic entirely, which cuts off the privacy tool that journalists, abuse survivors, dissidents and ordinary people on public Wi-Fi rely on. Either way, one state's rule sets the terms of access for the whole country.
This is the standard, predictable result of an impossibility mandate. Strict liability combined with imperfect technology pushes compliance toward the most restrictive option. The sensible response for a risk-averse operator is to over-collect identity data or over-block, and Utah's legislature, not the website, would be responsible for that outcome.
What the ruling leaves standing
The scope of the decision is narrow. Per Gizmodo, only the VPN-targeting provision is blocked, and Utah's broader 2023 age-verification requirement stays in effect while the litigation continues. A preliminary injunction is also not a final judgment. The state can appeal, and the full merits are still to be decided.
The ruling nonetheless offers a design lesson. Policymakers who want to protect minors have workable alternatives to an impossibility mandate:
- Reasonable-efforts standards. Require sites to use available geolocation signals, and treat good-faith compliance as a defense, rather than imposing strict liability.
- Device- and app-store-level controls. Place age signals where location and identity are already known, instead of forcing every website to infer them.
- Privacy-preserving verification. Favor methods that confirm age without storing identity, so compliance does not create a new breach target.
The takeaway
A pro-innovation, pro-speech view of online safety does not require pretending the problem is trivial. Minors do reach adult content, and VPNs are one route. But the answer cannot be a law that holds a company liable for facts it cannot know. Judge Barlow's reasoning follows a principle that cuts across politics: a state may regulate conduct within its borders, but it may not make the rest of the country comply with its rule because it cannot tell who is who. Legislators in other states weighing VPN clauses should read this opinion before they draft.