TL;DR
Get the latest gadgets delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A federal judge has issued a preliminary injunction blocking enforcement of Utah SB 73’s VPN provisions while the case proceeds. The ruling says the law likely requires websites to locate users with a degree of precision that current technology cannot provide, and may burden people and businesses outside Utah.
A federal judge has temporarily blocked enforcement of Utah’s SB 73 provisions targeting virtual private network use, ruling that the law likely requires covered websites to determine users’ physical locations with precision current technology cannot provide. The order, sought by Aylo, the parent company of Pornhub and other adult platforms, keeps the provisions on hold while its constitutional challenge continues.
SB 73 requires covered adult websites to block VPN users or identify the physical location of visitors whose network traffic is masked, according to the Electronic Frontier Foundation, which opposes the law. The statute also bars covered sites from providing instructions on using VPNs to bypass age-verification checks. Utah enacted the law earlier in 2026, and it was initially set to take effect in May.
Judge Barlow’s preliminary-injunction ruling found that the law likely imposes a substantial burden beyond Utah’s borders. The judge said the statute effectively requires sites to verify the ages of users everywhere because a site could face liability if even one visitor masking their location is in Utah. The ruling does not resolve the full constitutional case; it pauses enforcement of the challenged VPN provisions pending further court action.
The court described the location requirement as demanding “geolocation perfection” and acknowledged that such accuracy is not presently possible. EFF says that because a website sees the VPN server’s IP address rather than the user’s originating address, it cannot reliably distinguish a person connecting through a VPN from Utah from one connecting from another state or country. EFF’s account of the ruling says Aylo cited 28 million users who could have to undergo age verification to avoid liability.
Why Location Accuracy Matters
The dispute tests whether a state can make websites responsible for identifying the location of every visitor when users can route traffic through VPN servers. If Utah’s rule were enforced as written, sites could face a choice between blocking VPN traffic broadly, applying age checks to users outside the state, or restricting access from Utah. The court’s preliminary ruling signals that the geographic reach and technical demands of the law may pose constitutional problems.
EFF argues that the proposed enforcement approach could also increase surveillance. In comments to Utah’s Department of Commerce, the organization objected to proposed requirements for “commercially reasonable” systems to detect location obfuscation. EFF says suggested signals such as connection latency and device time zones are unreliable, and that monitoring them could lead to mistaken blocks and wider data collection. Those are EFF’s assessments; the injunction itself addresses the legal challenge, not a final finding on every concern raised in the comments.
As an affiliate, we earn on qualifying purchases.
How Utah’s VPN Provisions Emerged
Aylo filed a constitutional challenge after Utah passed SB 73. The company and the state initially agreed to pause enforcement while the court considered the request for an injunction or until the state finalized administrative rules. Utah’s Department of Commerce published proposed rules, identified as R152-78B, on September 1, 2026. EFF submitted comments opposing them.
The proposed rules could have taken effect as early as October 8, according to the notice described by EFF. The judge’s order means the challenged VPN provisions cannot be enforced while the court considers the case further. EFF says Utah was, to its knowledge, the first state to target VPN use in connection with legally required age-verification gates. Aylo’s lawsuit does not challenge the separate provision barring covered websites from sharing information about VPNs.
““The statute, as amended, now essentially imposes strict liability for entities like [Aylo] when it comes to determining the location of its websites’ users.””
— Judge Barlow, as quoted in the court ruling
The Case Is Not Decided
The injunction is preliminary, not a final ruling that SB 73 is unconstitutional. The case remains pending, and the court could reach a different conclusion after further proceedings. The available account does not specify a schedule for the next major court decision or the precise scope of any future changes to the law or its rules.
It is also not clear whether Utah will revise its approach or continue defending the challenged provisions. The ruling concerns the VPN-related provisions at issue in Aylo’s lawsuit; it does not block every part of SB 73. The separate restriction on providing VPN-use information was not challenged in Aylo’s case, according to EFF.
Further Court Review Ahead
Utah cannot enforce the challenged VPN provisions while the preliminary injunction remains in effect, pending further action by the court. The next steps are expected to come through the continuing constitutional case, where Aylo and the state can present further arguments. The state’s proposed administrative rules and EFF’s comments may also remain part of the wider dispute over how compliance would work.
Any final outcome could clarify whether Utah may impose location-detection and age-verification obligations on websites serving users beyond its borders. Until the court takes further action, the injunction is the operative order, but the law’s ultimate status remains unresolved.
Key Questions
What did the federal judge do?
The judge issued a preliminary injunction blocking enforcement of Utah SB 73’s VPN provisions while Aylo’s constitutional challenge proceeds.
Does the ruling strike down Utah’s entire law?
No. The order pauses the challenged VPN provisions; it is not a final decision on the law’s constitutionality. EFF also says Aylo did not challenge the separate provision about sharing VPN-use information.
Why did the judge say the requirement may be impossible?
A VPN routes traffic through an intermediary server, so the website generally sees the server’s IP address rather than a reliable indication of the user’s physical location. The judge said current tools cannot provide the perfection the law appears to require.
What happens while the case continues?
The challenged provisions remain unenforceable under the injunction pending further court action. The case is ongoing, and the timing and outcome of the next major ruling have not been specified in the source material.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
