Utah's VPN Age-Check Provision Blocked: Case Paused to 2027

A federal judge has blocked the part of Utah’s age-verification law that was written with VPN users in mind. On 24 September 2026, Judge David Barlow of the US District Court for the District of Utah granted a preliminary injunction. A preliminary injunction stops a law from being enforced while the case goes on. The injunction targets the “actual-location provision” of Utah’s S.B. 73. That provision treated a visitor as being in Utah “regardless of whether the individual is using a virtual private network, proxy server, or other means” to hide their location. The order blocks that provision, Utah Code section 78B-3-1002(3), and nothing else.

The case is Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340. It is now paused. On 12 October, Fox 13’s Ben Winslow reported that Judge Barlow had granted a joint request by both sides to stay the case, which means pausing it. The stay lasts until after the 2027 legislative session, because “the parties anticipate that the Utah Legislature may consider amending the statute”.

What happened

S.B. 73, Online Age Verification Amendments, took effect on 6 May 2026. It rewrote Utah’s 2023 age-check law. It also added two VPN subsections to section 78B-3-1002. Subsection (3) is the actual-location provision. Subsection (4) says a covered site “may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements”. That includes publishing instructions.

Aylo, which operates Pornhub, challenged only the actual-location provision. Utah agreed not to enforce it while the motion was pending. The court rejected Aylo’s argument that Utah was legislating beyond its borders. But it found that the provision likely violates the dormant Commerce Clause under the Pike balancing test. The dormant Commerce Clause limits state laws that burden trade between states. Under the Pike test, a court weighs that burden against the law’s local benefits.

The court said that, read with the rest of the statute, the provision “requires entities like Aylo to geolocate its website users with perfection to avoid liability”. It added that “it is undisputed that geolocation perfection is not presently possible”. The Attorney General had promised a reasonableness standard. The court refused to read that standard into a text that “says nothing about reasonableness in geolocation efforts”.

Why it matters

The provision never regulated VPN users. S.B. 73 puts the duty and the penalty on the site. Using a VPN in Utah was lawful and still is.

The provision made IP-based geofencing legally worthless. Geofencing means blocking visitors from a place based on their IP address. Aylo used it to keep its free sites away from Utah. Under the provision, a Utah resident arriving through an out-of-state server still triggered liability. So the only safe response was to age-verify everyone everywhere, which the Electronic Frontier Foundation called “a technical impossibility”.

Sites can now go back to blocking Utah IP addresses. The ban on sites publishing VPN instructions was not challenged and still stands. The ruling is preliminary. The Legislature meets from January 2027 and may rewrite the provision before the case resumes.

What to do

If you use a VPN in Utah, nothing changes, because the law never applied to users. Site operators keep the duties in subsections (1) and (4). For more detail:

• Our state-by-state tracker lists each law and its effective date.
• The age verification hub explains what a VPN changes and what it does not.
• The Texas page covers the 2025 Supreme Court decision.
• The best VPN for age verification page sets out what matters.
• The laws hub covers the UK and Australia.

What we changed

Our age verification laws by state page said that none of the state laws “says anything about VPN users”. It also said that “no US state has proposed anything aimed at VPNs”. Both statements were wrong from 6 May 2026, and we corrected them.

We added a Utah paragraph to that page’s state-by-state section. It covers the two VPN subsections, the 24 September injunction and the 12 October stay. We added those dates to the page’s timeline. We also added the injunction to the timeline of the age verification hub. Both pages still conclude that VPN use is lawful in every state.