TL;DR
Get privacy and security gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A federal judge issued a preliminary injunction blocking enforcement of Utah SB 73’s VPN-related provisions while a legal challenge proceeds. The order says the law likely burdens people and businesses outside Utah and requires websites to identify users’ locations with a level of accuracy that is not presently possible.
A federal judge has temporarily blocked Utah’s SB 73 VPN provisions, finding that the law likely requires adult websites to determine users’ physical locations with a level of accuracy that current geolocation tools cannot provide. The preliminary injunction, issued in a lawsuit brought by Aylo, the parent company of Pornhub, stops enforcement while the case continues and addresses concerns that the state law burdens users and businesses beyond Utah.
SB 73, signed into law earlier in 2026, regulates access to adult websites by requiring covered platforms to prevent minors from viewing material. Its VPN provisions require sites to block VPN users or establish users’ actual locations so Utah visitors can be subject to age verification. The law also bars covered websites from providing instructions about using a VPN to bypass the checks. The judge’s order applies to the VPN-related provisions; it does not resolve every aspect of the statute.
In the order, Judge Barlow said the law effectively places covered entities under strict liability for determining users’ locations. The court wrote that the statute requires websites to geolocate users “with perfection” to avoid liability, while acknowledging that “geolocation perfection is not presently possible.” It reasoned that the law may reach users outside Utah because a site could face liability if even one visitor using an obscuring tool were not identified correctly.
The Electronic Frontier Foundation, which submitted comments opposing the state’s proposed implementation rules, says a website generally sees the IP address of a VPN server rather than the user’s originating network address. EFF argues this leaves platforms with a choice between blocking VPN connections broadly or restricting access from Utah. The ruling cited a figure of 28 million users in discussing the reach of the verification burden; the source report does not provide a time period or comparison baseline for that number.
A State Rule With Nationwide Reach
The order matters because Utah’s requirements may shape how websites treat VPN users beyond the state’s borders. A platform serving users nationwide could have to identify every visitor’s location, or take broad steps to avoid liability, even though the law is aimed at protecting minors in Utah. The court’s preliminary assessment is that this could impose a substantial burden outside the state.
The dispute also concerns the privacy costs of enforcement. VPNs route traffic through intermediary servers, helping obscure a user’s network location from the destination website. EFF says the state’s proposed detection methods, including connection latency and device time-zone indicators, are unreliable and could misclassify users. Those are EFF’s arguments about the proposed rules, not findings that the court has made about every detection method or its effects.
For readers, the immediate consequence is limited but practical: the VPN provisions cannot be enforced while the injunction remains in place. The ruling does not establish that all age-verification laws are invalid, nor does it permanently settle Utah’s authority to regulate access to adult websites.
As an affiliate, we earn on qualifying purchases.
From May Deadline to Injunction
Aylo filed a constitutional challenge after SB 73 was enacted, with the law initially scheduled to take effect in May 2026. The company and Utah agreed to pause enforcement while the court considered a preliminary injunction request or until administrative rules specifying compliance requirements were finalized.
Utah’s Division of Consumer Protection published proposed rules, identified as R152-78B, on September 1. The notice said the rules could take effect as soon as October 8, 2026. EFF submitted comments to the Department of Commerce opposing them, arguing that the proposed requirement for “commercially reasonable geolocation obfuscation detection systems” would require intrusive monitoring and unreliable inferences about users’ locations.
The court’s order now prevents enforcement of the challenged VPN provisions pending further court action. EFF describes Utah as the first state, to its knowledge, to target VPN use in connection with legally mandated age-verification gates. That characterization is the organization’s account, rather than a separate finding stated in the court ruling.
“The law demands a technical impossibility.”
— Electronic Frontier Foundation
As an affiliate, we earn on qualifying purchases.
The Case Is Still Pending
The injunction is preliminary, not a final ruling on the constitutionality of SB 73. The court has not issued a final decision on Aylo’s challenge, and the available source does not detail the full schedule for further proceedings or whether Utah will appeal.
It is also not clear what changes, if any, Utah might make to the law or its administrative rules in response. Aylo’s lawsuit does not challenge the separate provision barring covered websites from sharing information about VPNs, according to EFF. The status of that provision is therefore distinct from the VPN-related requirements halted by this order.
As an affiliate, we earn on qualifying purchases.
Further Court Review Will Follow
The case will continue as the court considers Aylo’s challenge and whether the preliminary injunction should remain in effect. Until further court action, Utah cannot enforce the blocked VPN provisions. The Department of Commerce’s proposed rules may require revision or further consideration if the state seeks to implement the law within the limits identified by the judge.
The next significant development will be a later court order, ruling, or other filing clarifying the scope and duration of the injunction. The current source does not state a date for that milestone, so the timing remains undetermined.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the federal judge block?
The judge issued a preliminary injunction blocking enforcement of the VPN-related provisions of Utah SB 73 while Aylo’s lawsuit proceeds. The order is not a final decision on every part of the law.
Why did the judge question the law’s requirements?
The judge said the provisions appear to require websites to identify users’ physical locations with perfect accuracy to avoid liability, while recognizing that perfect geolocation is not presently possible.
Does the ruling end Utah’s age-verification law?
No. It temporarily halts the challenged VPN provisions. The court has not issued a final ruling on the law’s constitutionality or resolved every part of SB 73.
What happens to the proposed state rules?
Utah’s Division of Consumer Protection proposed rules to implement the law, and EFF filed comments opposing them. The injunction prevents enforcement of the covered VPN provisions while further court action is pending; the available report does not specify what changes the state will make to the rules.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
