Utah’s Department of Commerce has signed an enforcement freeze with Aylo, the parent company of Pornhub, while a federal judge reviews the ongoing lawsuit against the law. The law itself has not been struck down, and no court injunction has been issued. Utah has simply decided, on its own initiative, not to apply the rules against adult websites until the court rules. Which is another way of saying the state has quietly conceded, in practice, what VPN providers were saying from the start: the law as written cannot function.
What Just Changed
The mechanics of the freeze are straightforward but easy to miss. SB 73 remains legally in effect. It has not been suspended by a court, and no judge has declared it unconstitutional. What changed is that Utah’s Department of Commerce, the agency responsible for enforcing the age verification rules, has agreed with Aylo not to bring enforcement actions against adult platforms while the federal case plays out.
At the hearing that produced this agreement, the presiding federal judge stated he could not commit to a timeline for issuing a ruling on the underlying challenge. Which means the law is now in a legal limbo that could last weeks, months, or longer. On paper, SB 73 is alive. In practice, it does nothing.
Why Utah Backed Off
Aylo’s lawsuit argues that SB 73 sets a technical standard that no website can reliably meet. The core problem is well documented: there is no consistent way for a website to detect whether a given visitor is using a VPN, and there is no reliable way to determine whether that visitor is physically located in Utah rather than in any other state or country. Under SB 73, the website carries the liability regardless. That combination, ambiguous detection and strict liability, is what VPN providers have called a liability trap since the bill was first introduced.
NordVPN was among the industry voices making that case publicly before the law took effect. The company argued that requiring websites to distinguish VPN traffic from ordinary traffic is a technical problem the industry has not solved at scale. The Electronic Frontier Foundation raised parallel concerns, describing the law as a technical whack-a-mole with First Amendment implications. Utah’s decision not to enforce SB 73 while the court reviews it is not a formal admission that either critique was correct, but it lines up with those arguments in a way that is hard to ignore.
What This Means for VPN Users Right Now
For a resident of Utah using a VPN for the reasons the technology was actually built for, meaning privacy, security on public Wi-Fi, remote access to work resources, or streaming a service they subscribe to while traveling, nothing has changed in either direction. Ordinary VPN use in Utah was legal before September 3, it remained legal after the law took effect, and it remains legal now that the state has paused enforcement of the age verification provisions. SB 73 was never a VPN ban, and the current freeze does not change what regular users can and cannot do.
What the freeze does change is the practical risk landscape for the platforms the law targets. Adult sites subject to SB 73 no longer need to build compliance systems on a rushed timeline, at least until the federal court rules. That reprieve could disappear at any point, depending on how the judge decides. The uncertainty is now the whole story. For Utah readers looking for a practical breakdown of how to navigate access during the pause, our guide walks through the options.
Where NordVPN Fits
The SB 73 saga is a useful reminder of why the underlying case for a VPN has less to do with adult content or geographic loopholes and more to do with baseline privacy. When you connect through NordVPN, your traffic is encrypted between your device and a NordVPN server, your ISP loses visibility into which sites you actually visit, and websites see the VPN server’s IP address rather than your own. That protection applies to every ordinary online activity, from banking to airport Wi-Fi to preventing ISP-level tracking, and it operates independently of whatever any state legislature does next.
NordVPN also operates under a no-logs policy that has been independently audited multiple times, which is part of why it consistently ranks near the top of most best VPN comparisons focused on privacy-first architecture. The company runs more than 7,000 servers across 118 countries, supports up to 10 simultaneous device connections per account, and uses the NordLynx protocol built on WireGuard for the encryption layer.
NordVPN Basic at $3.49 per Month
NordVPN’s Basic plan is currently available at $3.49/month, which works out to $94.23 billed once for 27 months of service (24 + 3 free). That is a 69% discount off the standard rate. Annual renewal continues at $139.08/year, cancelable from the account dashboard at any time.
The Basic plan covers the core VPN across up to 10 devices with applications for Windows, macOS, Linux, iOS, Android, browser extensions, and router installation for whole-household coverage. Everything runs on the audited server infrastructure that the no-logs policy reports cover.
Get NordVPN Basic at $3.49/month
30-Day Money-Back Guarantee
NordVPN backs every plan with a 30-day money-back guarantee. If the service doesn’t fit the way you use your devices, you can request a full refund within the first month. Refunds are processed through 24/7 chat support, and funds typically return within 5 to 10 business days depending on the payment method used.
That gives you a full month to install the apps across your setup, test the speeds on your home connection, and see whether the service holds up before the refund window closes. A note on the subscription: the $3.49/month rate applies to the first 27 months. Auto-renewal kicks in at the standard annual rate after that. If you would rather cancel or renegotiate before renewal, set a reminder in your calendar 7 to 10 days before the renewal date.