TL;DR
Get monitors, keyboards and dev gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A federal judge issued a preliminary injunction blocking enforcement of Utah SB 73’s provisions targeting VPN use while a legal challenge proceeds. The court said the law appears to require websites to locate users with a level of accuracy that is not currently possible, potentially burdening users and businesses beyond Utah.
A federal judge has temporarily blocked Utah from enforcing the VPN provisions of its age-verification law, ruling that the requirements likely impose an unconstitutional burden beyond state borders and demand geolocation accuracy that is not presently possible. The preliminary injunction applies while a lawsuit brought by Aylo, the parent company of Pornhub and other adult websites, proceeds.
Utah’s SB 73 requires covered adult websites to block VPN users or determine the physical location of visitors using VPNs and similar tools that mask network traffic. The law also bars covered sites from providing instructions on using a VPN to get around its checks. The court’s order blocks enforcement of the law’s VPN provisions for now; it does not resolve the full legal challenge or invalidate the law permanently.
In its ruling, Judge Barlow said the law effectively exposes companies to liability if they fail to locate users accurately. The court wrote that the statute “essentially imposes strict liability” on companies such as Aylo when determining users’ locations, while recognizing that “geolocation perfection is not presently possible.” EFF, which filed comments opposing proposed implementation rules, welcomed the decision.
The order followed the state’s publication of proposed administrative rules on September 1, 2026. Those rules would have required covered businesses to use “commercially reasonable geolocation obfuscation detection systems.” EFF argued that proposed detection approaches, including checking connection latency or device time zones, are unreliable and could lead to mistaken blocks and additional data collection. Those concerns are EFF’s assessment, not findings established by the injunction.
Why VPN Checks Reach Beyond Utah
The dispute concerns whether a state can make websites change how they handle users connecting through VPNs, even when those users are outside Utah. The judge’s reasoning focuses on the law’s potential reach: the court said a site might have to verify every visitor’s age if it could not rule out that a visitor was masking a Utah location. That could impose compliance obligations on users and businesses nationwide.
VPNs route traffic through intermediary servers, so a website generally sees the server’s IP address rather than a user’s actual network location. EFF says this makes precise location detection infeasible and that enforcing the law could push websites to block VPN traffic broadly or restrict access from Utah. The court’s order does not establish that those outcomes will occur, but it allows the challenge to continue without enforcement of the disputed provisions in the meantime.
As an affiliate, we earn on qualifying purchases.
How SB 73 Reached Federal Court
Utah enacted SB 73 earlier in 2026, with implementation initially expected in May. Aylo filed a constitutional challenge, and the company and state agreed to pause enforcement while the court considered a request for preliminary relief or until administrative compliance rules were finalized. The September rules prompted EFF to submit comments to the Utah Department of Commerce opposing the proposed approach.
EFF says Utah was, to its knowledge, the first state to target VPN use in connection with legally required age-verification checks. Aylo’s lawsuit, as described by EFF, does not challenge the separate provision barring covered websites from sharing information about VPNs. The current court order addresses the VPN-related requirements at issue in the challenge, not every provision of SB 73.
““Geolocation perfection is not presently possible.””
— Judge Barlow
VPN obfuscation detection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Scope of the Injunction and Case
The ruling is a preliminary injunction, not a final judgment on whether SB 73 is constitutional. The case remains active, and the source material does not specify a schedule for further court proceedings or whether Utah will appeal. It is also unclear what final compliance rules the state may pursue if the litigation continues.
The injunction blocks the challenged VPN provisions pending further court action. The available information does not establish that all parts of SB 73 are paused, or that the separate restriction on sharing VPN instructions is covered by Aylo’s lawsuit. EFF says that provision is not challenged in the case.
geolocation accuracy testing devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Further Court and State Action
The immediate next step is further proceedings in Aylo’s case, where the court will consider the challenge beyond the preliminary-injunction stage. Until the court takes further action, the order prevents enforcement of the covered VPN provisions. The state may also need to respond to the injunction and determine how it will proceed with the administrative rules published by the Department of Commerce.
EFF’s comments opposing those proposed rules are part of the separate rulemaking process. The source material does not report a final decision by the department or a date for the next court hearing, so the timing and shape of any additional state or judicial action remain open.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the judge block?
The judge temporarily blocked enforcement of SB 73’s VPN-related provisions while Aylo’s lawsuit proceeds. The injunction is preliminary, not a final ruling on the law.
What does Utah’s law require of adult websites?
SB 73 requires covered sites to block VPN users or determine the physical location of visitors using VPNs or similar tools. It also prohibits covered sites from sharing instructions on using a VPN to bypass the checks.
Why did the court question the location requirements?
The judge said the law appears to require websites to locate users with near-perfect accuracy, while acknowledging that perfect geolocation is not currently possible. The court also raised concern that compliance could require age checks for visitors outside Utah.
Has the court ruled that all of SB 73 is unconstitutional?
No. The court issued a preliminary injunction covering the disputed VPN provisions while the case continues. The ruling is not a final decision on the law’s constitutionality.
What happens next?
The lawsuit will continue, and the court may take further action. The injunction remains in place pending that action; the source material does not give a date for the next hearing or a final decision on the state’s proposed rules.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
