A federal court in Utah has halted enforcement of SB 73, a state law that tried to force adult websites to detect and block Virtual Private Network (VPN) users or precisely pinpoint their physical location. The ruling is a significant win for digital privacy advocates, including the Electronic Frontier Foundation (EFF), which argued the law asked companies to do something no current technology can reliably achieve: verify a user’s real-world location with perfect accuracy, every time, for every visitor.

What Utah’s SB 73 Actually Required

Signed into law earlier this year, SB 73 was designed to enforce age-verification requirements on adult websites by targeting the privacy tools people use to get around such checks. Specifically, the law required covered platforms to either block VPN users outright or identify the actual physical location of any visitor using a VPN or similar traffic-masking technology. It went further still, prohibiting websites from even publishing instructions that explained how to use a VPN to bypass the state’s age-verification gates. According to EFF, this made Utah the first state to directly target VPN usage as a method of avoiding mandated age checks.

The law was originally scheduled to take effect in May 2026. Aylo, the parent company of major adult platforms including Pornhub, filed a constitutional challenge almost immediately. Utah and Aylo agreed to pause enforcement while the court considered a preliminary injunction, and while the state finalized administrative compliance rules. Those rules, published September 1st by the Utah Department of Commerce, drew formal opposition comments from EFF, which detailed why the law’s technical demands were unworkable. The rules were slated to take effect October 8, 2026, but the court’s ruling means they cannot currently be enforced.

Why the Court Called This a Technical Impossibility

The central problem, as the court found, is geolocation accuracy. VPNs work by routing a user’s internet traffic through an intermediary server, often in another state or country, which masks the user’s true IP address and location. This is a core privacy and security feature used by journalists, activists, remote workers, and ordinary people protecting themselves from surveillance or data collection, not just a tool for evading age checks.

SB 73 effectively demanded that websites identify every visitor’s true location with certainty, even when that visitor is deliberately using tools designed to obscure it. Judge Barlow ruled that the statute “requires entities like Aylo to geolocate its website users with perfection to avoid liability,” while acknowledging that “geolocation perfection is not presently possible.” In other words, the law created strict liability for a technical outcome that cannot be guaranteed by any existing method.

The practical effect, the court noted, was even broader than it might first appear. Because a site cannot know in advance which visitors are obfuscating their location, the law’s “actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location,” since the site would violate the law if even a single visitor turned out to be in Utah while hiding behind a VPN.

A Constitutional Problem Beyond Utah’s Borders

The court’s ruling rested on more than just technical feasibility. It found that SB 73 likely violates the U.S. Constitution’s restrictions on states passing laws that significantly burden people and businesses outside their borders. Because websites cannot distinguish Utah visitors from everyone else once VPNs are involved, compliance effectively forces every user worldwide to go through age verification, regardless of where they actually live. The court concluded that Utah had less burdensome alternatives available to keep minors in the state away from adult content, rather than imposing a global verification mandate through the back door.

It’s worth noting a limit to this ruling: Aylo’s lawsuit did not challenge the separate part of SB 73 that prohibits websites from sharing information about VPNs, so that provision was not directly addressed by this decision.

How This Differs from Other Age Verification Laws

Many states have passed age-verification laws for adult content in recent years, typically requiring some form of ID check or age estimation at the point of access. What set Utah’s law apart was its direct attempt to regulate the privacy infrastructure itself, VPNs, rather than just the verification step. Instead of only asking “is this user old enough,” SB 73 effectively asked websites to also answer “is this user telling the truth about where they are,” and to treat any uncertainty as a compliance failure. That combination of mandatory location certainty and liability for privacy tool usage is what made the law unusually aggressive, and what ultimately made it vulnerable in court.

What This Means for Developers and Platform Operators

For now, companies operating adult websites that serve Utah users do not need to implement the VPN-blocking or location-verification systems SB 73 demanded, since the preliminary injunction halts enforcement pending further court proceedings. More broadly, the decision reinforces a legal principle that matters well beyond this one law: state regulators cannot mandate outcomes that current technology cannot reliably deliver, and cannot use liability rules to effectively project their jurisdiction onto users and companies everywhere else. Developers building geolocation, age-verification, or compliance tooling should watch for how other states may try similar approaches, since this ruling is likely to be cited in future challenges to comparable laws.

Frequently Asked Questions

Does this ruling mean VPNs are now explicitly protected by law in Utah? Not exactly. The ruling blocks enforcement of SB 73’s VPN-related provisions because they were found likely unconstitutional and technically unworkable, but it does not establish a broader standalone right to use VPNs. The case is still ongoing.

Is the provision banning VPN instructions still in effect? According to the excerpt, Aylo’s lawsuit did not challenge that specific provision, so this ruling does not directly address it.

Could other states pass similar anti-VPN laws? It’s possible, but this ruling provides a strong legal precedent that such laws may face the same constitutional and technical objections that led to Utah’s law being blocked.

Source: Court agrees with EFF: Utah’s VPN law demands a technical impossibility