Federal Judge Blocks Utah VPN Age Verification Rule

Last Updated on September 29, 2026 by Dana Groves

A federal judge has temporarily blocked the part of Utah's age-verification law that treated a VPN user as a Utah user. Judge David Barlow found the “actual location” rule likely violates the U.S. Constitution because no website can track a masked connection with certainty.

Table of Contents

What Happened

On September 24, U.S. District Judge David Barlow granted a preliminary injunction against the actual-location provision of Utah Senate Bill 73, the “Online Age Verification Amendments” signed by Governor Spencer Cox on March 19, 2026. The injunction stops Utah from enforcing Utah Code section 78B-3-1002(3), the clause that declared a person to be accessing a website from Utah if that person was physically in the state, no matter what a VPN or proxy server did to the connection.

The challenge came from Aylo, the parent company of Pornhub, which filed its complaint in April 2026 in the U.S. District Court for the District of Utah. Aylo argued that the rule would force it to verify ages “for every user of their platforms, anywhere in the world,” because it cannot tell which masked visitors are sitting in Utah. In a 40-page opinion, Barlow agreed that the text imposes strict liability, writing that companies would have to “geolocate its website users with perfection to avoid liability” to stay out of trouble.

Utah Attorney General Derek Brown had argued that the state only expected reasonable efforts, using signals such as a visitor's time zone, browser language, currency settings, and account history. Barlow rejected that framing, ruling that the court must “analyze the statutory text the Legislature passed into law, not just the Attorney General's proposed enforcement of it.”

Key Facts

Ruling: preliminary injunction issued September 24, 2026 by U.S. District Judge David Barlow.
Law: Utah SB 73, the Online Age Verification Amendments, signed by Governor Spencer Cox on March 19, 2026.
Provision blocked: Utah Code section 78B-3-1002(3), the actual-location clause covering VPN and proxy users.
Plaintiff: Aylo, parent company of Pornhub, which filed in April 2026.
Judge's finding: the clause is likely to violate the dormant Commerce Clause and requires companies to “geolocate its website users with perfection.”
Agreed fact: perfect geolocation technology does not exist today.
State's claim: reasonable effort is enough, judged on clues such as time zone, language, currency, and account activity.
Not affected: Utah's broader age-verification requirements stay in force while the case continues.
First of its kind: SB 73 was the first U.S. state law to write VPN use directly into an age-verification rule.
Status: the injunction lasts until the court rules on the provision's constitutionality; Utah can still appeal.

What It Means

For everyday users, the immediate effect is simple: using a VPN in Utah stays legal, and the rule that punished websites for your encrypted connection is on hold. The wider signal matters more. Utah was the test case for treating a privacy tool as a compliance problem, and at least two dozen other states are weighing age-verification rules of their own. The Electronic Frontier Foundation, which called the provision a “liability trap,” warned that the requirement could have pushed platforms to either ban every known VPN IP address or check the age of every visitor on Earth.

The ruling does not settle the tougher question of how far a state can reach beyond its borders. It only says Utah cannot demand a level of location accuracy that no site can deliver. Companies like Surfshark VPN and Proton, which both commented on the case, framed the outcome as confirmation that a standard security tool should not be treated as a loophole.

Related Guide

If you want to understand how a VPN hides your IP address in the first place, our VPN tunnel guide walks through the encryption handshake and what a provider can and cannot see.

None of this is legal advice. Rules on VPNs, age checks, and geo-restricted content differ by state and country, so check your local laws and the terms of service of any platform you use. A VPN is a privacy and security tool, and how you use it is your responsibility.

Source: Electronic Frontier Foundation and XBIZ.