Utah tried to crack down on one of the biggest workarounds to its online age-verification laws, however, a federal judge just blocked the effort.
U.S. District Judge David Barlow granted a preliminary injunction on Sept. 24 blocking a new provision of Utah’s age-verification law aimed at people who use VPNs to hide their location.
The ruling is part of a lawsuit brought by Aylo, the parent company of Pornhub.
Barlow found that Aylo was likely to succeed in arguing that the provision violates the Constitution’s dormant Commerce Clause, which limits states from imposing excessive burdens on interstate commerce. The judge found that Utah’s law would effectively force websites to verify users beyond the state’s borders.
The ruling comes as governments around the world, including dozens of U.S. states, have increasingly passed laws in recent years requiring some form of age verification to access certain types of online content, usually pornography.
These laws typically require users to prove their age by either uploading a government ID or through a third-party age-verification service. Utah has required adult sites to use age-verification systems since 2023.
But VPNs have long offered a simple way around these restrictions. They can route a user’s internet traffic through another location, making someone in Utah appear to be connecting from another state or country.
Utah aimed to close that loophole this year. A new law known as the Online Age Verification Amendments took effect in May, updating the state’s 2023 age-verification law.
The new provision stated that a person is considered to be accessing a website from Utah if they are physically located in the state, regardless of whether they use a VPN or any other method to hide their location.
The Electronic Frontier Foundation warned at the time that holding companies liable for verifying the age of users in Utah, including those using VPNs, is technically unrealistic because websites generally cannot determine a VPN user’s actual location reliably. According to the group, that could force websites to either “ban all known VPN IPs, or to mandate age verification for every visitor globally.”
Aylo filed its lawsuit shortly before the new provision took effect. The company argued similarly that because there is no way to determine every internet user’s physical location with certainty, the law could effectively require it to age-verify all its users around the world to make sure none of them are actually in Utah.
Barlow largely agreed with that argument. In his ruling, he wrote that the law requires companies like Aylo to “geolocate its website users with perfection to avoid liability.”
Utah Attorney General Derek Brown’s office, on the other hand, argued that the statute does not require perfection, but rather reasonable efforts to determine which users are actually located in Utah.
Still, Barlow wasn’t convinced. He wrote that the court has to “analyze the statutory text the Legislature passed into law, not just the Attorney General’s proposed enforcement of it.”
The injunction only blocks the new provision targeting users who hide their location. Utah’s broader age-verification law remains in effect while the lawsuit moves forward.
Aylo and the Utah Attorney General’s Office did not immediately respond to requests for comment.
