TL;DR
Get the latest gadgets delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A federal judge issued a preliminary injunction barring enforcement of Utah SB 73’s VPN-related provisions while litigation continues. The court said the law likely creates constitutional problems by requiring websites to locate users with a level of accuracy that is not currently possible.
A federal judge has temporarily blocked enforcement of Utah SB 73’s VPN provisions, ruling that the law likely violates the U.S. Constitution by placing burdens on websites and internet users outside Utah. The order, welcomed by the Electronic Frontier Foundation (EFF), says the law appears to require websites to determine users’ physical locations with a degree of accuracy that current geolocation technology cannot provide.
SB 73 applies to covered adult websites and requires them to prevent Utah residents from using virtual private networks, or VPNs, to avoid age-verification checks. Under the law, sites must block VPN users or identify the physical location of visitors using tools that obscure network traffic. It also prohibits covered websites from providing instructions on using a VPN to bypass the checks. The preliminary injunction blocks the VPN-related provisions during the ongoing court case; it is not a final ruling on the law’s constitutionality.
Judge Barlow wrote that the law’s location requirement effectively makes websites responsible for identifying every visitor’s location, because a site could face liability if even one user obscures their location. The ruling states that the law “requires entities like Aylo to geolocate its website users with perfection to avoid liability,” while acknowledging that “geolocation perfection is not presently possible.” Aylo, the parent company of Pornhub and other adult platforms, brought the lawsuit challenging the law.
The case does not challenge SB 73’s separate restriction on websites sharing information about VPNs, according to EFF. The injunction follows a pause in enforcement that Utah and Aylo had agreed to while the court considered the challenge or state regulators finalized compliance rules. The Utah Department of Commerce published proposed rules on September 1, 2026. EFF says it submitted comments opposing them; the rules were proposed to take effect as soon as October 8, but the court’s order prevents enforcement of the blocked provisions pending further court action.
A State Law With Nationwide Reach
The dispute matters beyond Utah because websites accessible across state lines may have to change how they handle visitors everywhere to avoid liability under one state’s law. The judge’s reasoning focuses on that reach: if a site cannot reliably distinguish a Utah visitor using a VPN from a visitor elsewhere, it may have to verify the ages of users nationwide or block VPN traffic more broadly. The court said Utah has less burdensome ways to address minors’ access to adult websites than imposing requirements that affect users outside the state.
EFF argues that identifying and blocking VPN use would also require additional monitoring of connections and devices. In comments to the state, the organization said proposed detection approaches, such as examining connection latency or device time zones, can be unreliable and may lead to mistaken blocks. Those concerns are EFF’s assessment, not separate findings established by the injunction. The court’s immediate decision is narrower: the VPN provisions cannot be enforced while the litigation continues.
As an affiliate, we earn on qualifying purchases.
How SB 73 Reached Federal Court
Utah enacted SB 73 earlier in 2026, with enforcement initially scheduled to begin in May. Aylo filed a constitutional challenge, and the parties agreed to pause enforcement while the court considered a request for a preliminary injunction or state administrative rules clarified compliance. The case centers in part on whether Utah can impose requirements on websites serving users well beyond its borders.
The state’s proposed administrative rules, identified as R152-78B, were published by the Division of Consumer Protection on September 1. EFF submitted comments opposing the rules, arguing that requiring companies to detect tools that obscure location would undermine privacy and security. EFF says VPNs route traffic through intermediary servers, so websites generally see the server’s IP address rather than a user’s actual network location. The injunction followed that regulatory process and the court’s review of Aylo’s challenge.
““The statute, as amended, now essentially imposes strict liability for entities like [Aylo] when it comes to determining the location of its websites’ users.””
— Judge Barlow
As an affiliate, we earn on qualifying purchases.
The Lawsuit Is Still Pending
The injunction is preliminary, and the court has not issued a final decision on whether SB 73 is unconstitutional. The order blocks the law’s VPN provisions while the case proceeds, but the source material does not specify a date for the next hearing or a final ruling. It is also not clear what changes, if any, Utah regulators will make to the proposed rules in response to the order.
The scope of any later decision remains open. Aylo’s lawsuit does not challenge the provision barring covered websites from sharing information about VPNs, according to EFF, so the injunction should not be read as resolving that separate restriction. The source material also does not detail how the court will address the law’s age-verification requirements apart from their connection to VPN use and location detection.
As an affiliate, we earn on qualifying purchases.
Court Review Will Continue
Utah and Aylo are expected to continue litigating the constitutional challenge, with enforcement of the blocked VPN provisions on hold pending further court action. The Department of Commerce’s proposed rules may also be affected, but the supplied information does not say whether the agency plans to revise, suspend, or withdraw them. Any later court ruling or agency action will clarify how much of SB 73 can proceed and what requirements covered websites must meet.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the judge block?
The judge issued a preliminary injunction preventing enforcement of the VPN-related provisions of Utah SB 73 while the lawsuit continues. The order is temporary, not a final ruling on the statute.
What does Utah SB 73 require of covered websites?
The law requires covered adult websites to block VPN users or identify the physical location of visitors using VPNs and similar tools, in connection with age-verification requirements. It also restricts the sites from providing instructions on using VPNs to bypass those checks.
Why did the court question the location requirement?
The judge said the law appears to require websites to determine users’ locations with perfect accuracy, even though perfect geolocation is not currently possible. VPNs can make a website see an intermediary server’s address rather than the visitor’s actual location.
Does the ruling end Utah’s age-verification law?
No. The injunction blocks the VPN provisions while the case proceeds. The court has not issued a final decision on the law’s constitutionality, and the source material does not establish that every part of SB 73 has been halted.
What happens next?
The legal challenge continues, and the court may issue further orders. Utah regulators may also respond to the injunction concerning the proposed compliance rules, but no specific next hearing date or agency decision was provided.
Source: fediverse
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
