A federal judge has blocked Utah’s requirement that adult websites identify users physically located in the state even when they conceal their location with a VPN, finding that the provision demands accuracy current technology cannot deliver.
US District Judge David Barlow issued the preliminary injunction on September 24 in a lawsuit brought by Aylo Freesites and Aylo Group. The court found that the requirement likely violates the Constitution’s dormant Commerce Clause by imposing excessive burdens on interstate commerce.
The Electronic Frontier Foundation (EFF) welcomed the decision, linking it to privacy concerns the organization raised in comments opposing Utah’s proposed implementation rules.
Aylo operates Pornhub, YouPorn, and RedTube. According to evidence cited in the ruling, its free platforms receive more than 200 million active visitors monthly, approximately 86% of whom are outside the United States.
A requirement for perfect geolocation
Utah’s SB 73 expanded the state’s age-verification framework to cover users actually located in Utah, regardless of whether they use VPNs, proxy servers, or other tools to disguise their location.
VPNs route traffic through intermediary servers, making the server’s IP address visible to websites instead of the visitor’s original address. Although detection services and other signals can improve location estimates, both sides agreed that websites cannot establish every visitor’s physical location with perfect certainty.
Utah argued that the law required only reasonable efforts. Its proposed approach involved detecting location-masking tools, examining indicators such as device time zones and language settings, and asking selected users to provide location data, undergo age checks, or disable their VPN.
Barlow rejected that interpretation. While the statute expressly permits reasonable age-verification methods, its location requirement contains no equivalent qualification.
The court concluded that the amendment requires websites to “geolocate its website users with perfection to avoid liability,” despite agreement that such perfection is currently impossible.
That distinction undermines reliance on IP-based restrictions. Aylo initially blocked Utah IP addresses after the state introduced age verification in 2023, later allowing those addresses to access only content outside the law’s scope.
Under the amendment, however, an undetected Utah visitor could still expose the company to liability. The judge reasoned that avoiding that risk would require checking every visitor’s age, including approximately 28 million monthly US users.
Although protecting minors is a substantial state interest, the court found that Utah could pursue it through less burdensome means.
Age checks remain in place
The injunction applies specifically to Utah Code § 78B-3-1002(3), the actual-location provision. It leaves the underlying age-verification requirement in place and represents preliminary relief rather than a final judgment.
EFF also noted that Aylo’s lawsuit does not challenge SB 73’s separate prohibition on covered websites providing instructions for using VPNs to bypass age checks.
Meanwhile, EFF warned that Utah’s proposed detection rules could encourage additional tracking while misclassifying legitimate users. Those rules were published September 1, with October 8 listed as their earliest possible effective date.
Leave a Reply