Utah's Department of Commerce began enforcing SB 73's adult-site age-verification requirements statewide on 2 November 2026, according to KUTV. One piece of the law is still frozen. On 24 September 2026, federal district judge David Barlow enjoined Utah Code 78B-3-1002(3), the provision that would make sites treat VPN users by their physical location in Utah, KPCW reported. The split outcome shows what regulators can and cannot ask of technology.
The strongest case for Utah
Utah's argument deserves a fair hearing. Children can reach explicit material in seconds, and a law that checks age only for users who identify themselves as Utahns would be trivially easy to evade. If a teenager can install a VPN and be treated as a Californian, the age gate protects no one. The sponsor, Sen. Calvin Musselman, called enforcement "a necessary step to ensure that Utah's youth are shielded". The Supreme Court has also given states room here: in Free Speech Coalition v. Paxton (decided June 27, 2025) it upheld Texas's age-verification law for adult sites, applying intermediate scrutiny rather than strict scrutiny. Utah is not acting outside the constitutional lane the Court opened.
What the court actually found
The injunction did not rest on a view that age checks are illegitimate. It rested on a technical fact. Judge Barlow agreed that the law would require a company like Aylo to "geolocate its website users with perfection to avoid liability", and that it is undisputed that technology capable of perfect geolocation does not exist. The Utah Attorney General argued the state wants only a "reasonable effort." The court responded that it must analyze the statutory text the Legislature passed, not the Attorney General's proposed enforcement of it.
The EFF's account of the ruling adds the constitutional basis: the law likely violates the prohibition on laws that significantly burden businesses and people outside Utah's borders. A VPN exit node can sit in another state or country. A site that cannot see through it has two choices under a perfection standard: verify everyone on earth, or block everyone who looks like they might be hiding.
That second option is what makes the VPN provision a speech problem and not only a compliance problem. Adults who use VPNs for ordinary privacy reasons (on public Wi-Fi, to avoid tracking, to protect a source) would be swept into mandatory identity checks or shut out.
Why the surviving mandate still matters
Utah has said the ruling does not pause SB 73 as a whole, and the age-verification requirement remains enforceable. Commerce officials said state investigators are prepared to audit whether covered sites have implemented the required checks. Aylo said its operations would not change, since it already complied with Utah's 2023 law, per TechRadar's reporting.
Two features of the broader statute remain live. First, Aylo's suit does not challenge the provision barring covered sites from sharing information about VPNs, according to EFF. A rule that stops a site from telling users how lawful privacy tools work is a content restriction in its own right, and it has drawn less attention than the geolocation fight. Second, the statute now rewards over-blocking. With a location-perfection duty enjoined, the commercial pressure to treat all VPN traffic as suspect has not disappeared, because the underlying penalties for non-compliance have not.
The state's rulemaking compounds this. EFF filed comments opposing the Division of Consumer Protection's proposed implementing rules, objecting to both the VPN provisions and the age-verification framework. Rules and statute should not be asked to do what the court has just said the technology cannot do.
Proportionate regulation would look different
A pro-innovation approach does not require ignoring child safety. It requires matching the duty to what can be measured:
- Define the duty by effort, not outcome. A standard of commercially reasonable measures, with a safe harbor for sites using recognized assurance methods, is enforceable. A perfection standard is not, as the court found.
- Keep privacy-preserving verification central. Age assurance that confirms an attribute without retaining identity limits the breach risk that a centralized adult-site ID database would create.
- Leave lawful privacy tools alone. Targeting VPN use itself, or banning speech about VPNs, sweeps in journalists, abuse survivors and ordinary users. Device-level and parental controls reach the child without burdening every adult.
- Do not export one state's rules. The dormant Commerce Clause concern the court recognized is real: a patchwork of 50 geolocation regimes would push sites to apply the strictest to everyone.
Utah's legislators have signalled they may revise the law next session. The sensible revision is to drop the location-perfection duty rather than redraft it as a vaguer one. A statute that survives only because enforcement is selective is a worse outcome for both regulators and regulated parties.
What to watch
The injunction is preliminary. The case continues, and Utah may appeal. Meanwhile, the first audits under the age-verification requirement will show whether the state enforces against the large compliant platforms that already verify users, or against smaller sites that cannot afford vendors. Utah's experience will be read by other legislatures considering VPN-related language. The court has made clear that physics, not just policy preference, sets the outer limit.