TL;DR
Get privacy and security gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A federal judge issued a preliminary injunction blocking enforcement of the VPN provisions in Utah’s SB 73 while a constitutional challenge proceeds. The ruling says the law likely requires websites to locate users perfectly, which the court said current technology cannot do, and could burden users and businesses outside Utah.
A federal judge has temporarily blocked Utah’s SB 73 VPN provisions, ruling that the law likely requires websites to locate users with a level of accuracy that current technology cannot provide. The order, described by the Electronic Frontier Foundation (EFF), pauses enforcement while a constitutional challenge brought by Aylo, the parent company of Pornhub and other adult websites, continues.
SB 73 requires covered adult websites to prevent minors in Utah from accessing their services. Its VPN-related provisions require those businesses to either determine visitors’ physical locations and block people in Utah, or verify the age of every visitor in case that person is in the state. The law also bars covered sites from providing instructions about using a VPN to bypass the checks; Aylo’s lawsuit does not challenge that separate restriction, according to EFF.
Judge Barlow found that the law likely places an unusually demanding burden on sites because VPNs route traffic through intermediary servers. A website generally sees the VPN server’s internet address rather than the user’s actual location. The judge wrote that the law “requires entities like Aylo to geolocate its website users with perfection to avoid liability,” while acknowledging that “geolocation perfection is not presently possible.”
The court’s order blocks the VPN provisions pending further action in the case. EFF said the ruling followed the state’s proposed administrative rules, which would have required businesses to use “commercially reasonable geolocation obfuscation detection systems.” The organization submitted comments opposing those rules, arguing that suggested signals such as connection latency and device time zones are unreliable and could lead to privacy harms and mistaken blocks. Those concerns are EFF’s position, not findings established by the court in the material provided.
A State Rule With National Reach
The dispute matters beyond Utah because websites reachable across state lines may have to change how they handle visitors nationwide to avoid liability under a state law. The judge’s ruling focuses on that reach: according to EFF’s account, the court concluded that the statute likely burdens people and businesses outside Utah, raising a constitutional concern about a state regulating conduct beyond its borders.
It also highlights a practical conflict between age-verification rules and privacy tools. VPNs can obscure a user’s location from the destination website, while SB 73 relies on sites identifying whether visitors are physically in Utah. If a site cannot distinguish Utah users from people elsewhere with certainty, the law may pressure it to verify everyone, block VPN connections broadly, or restrict access for Utah users. The injunction prevents enforcement of the challenged VPN provisions for now; it does not resolve the underlying constitutional case.
As an affiliate, we earn on qualifying purchases.
How SB 73 Reached Court
Utah enacted SB 73 earlier in 2026, and the law was initially scheduled to take effect in May. Aylo filed a constitutional challenge. The state and company then agreed to pause enforcement while the court considered a request for preliminary relief or until the state finalized administrative compliance rules.
The Utah Department of Commerce’s Division of Consumer Protection published proposed rules, identified as R152-78B, on September 1, 2026. EFF submitted comments opposing the proposal. The notice said the rules could take effect as soon as October 8, but Judge Barlow’s injunction means the challenged VPN provisions cannot be enforced while the order remains in place. EFF described Utah as the first state, to its knowledge, to target VPN use in connection with legally mandated age-verification gates.
““Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users.””
— Judge Barlow, as quoted in the EFF report
geolocation obfuscation detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Challenge Is Still Pending
The preliminary injunction is not a final ruling on whether SB 73 is unconstitutional. The case remains before the court, and the source material does not specify a date for a final decision or describe any appeal. The injunction’s duration and any later changes to the statute or administrative rules are also not established in the information available.
The ruling addresses the challenged VPN provisions, not every part of SB 73. In particular, Aylo has not challenged the provision restricting covered websites from sharing VPN-use instructions. The precise effect of the injunction on the state’s proposed rules, beyond barring enforcement of the covered VPN requirements pending further court action, is not detailed in the source report.
As an affiliate, we earn on qualifying purchases.
Court Review and State Rules
The next major development will be further action in Aylo’s lawsuit, which could include additional court proceedings on the constitutional claims. Utah’s proposed administrative rules may also face further review, but the available report gives no schedule for either process. For now, the preliminary injunction prevents enforcement of the VPN provisions while the court considers the case.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the judge block?
The judge temporarily blocked enforcement of SB 73’s VPN-related provisions while Aylo’s legal challenge proceeds. The order is preliminary, not a final decision on the law’s constitutionality.
What does Utah’s law require websites to do?
SB 73 requires covered adult websites to prevent minors in Utah from accessing their services. The challenged provisions require sites to locate and block Utah visitors or verify every visitor’s age in case they are in Utah, including people using VPNs.
Why did the court question the law’s technical demands?
A VPN routes traffic through another server, so the destination site may see the server’s location rather than the user’s. Judge Barlow said the law appears to demand perfect geolocation, which the court said is not presently possible.
Does the injunction resolve the whole case?
No. It pauses enforcement of the challenged provisions while the case continues. The court has not issued a final ruling on the constitutional claims, and Aylo has not challenged the law’s separate restriction on providing VPN instructions.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
