A federal judge has preliminarily barred Utah from enforcing a provision of its adult-site age-verification law that treats a person as being in the state even when a virtual private network, or VPN, makes the connection appear to originate elsewhere. The ruling leaves Utah’s underlying requirement for adult-content sites to use reasonable age-verification methods in place.
U.S. District Judge David Barlow’s order applies specifically to Utah Code section 78B-3-1002(3), the statute’s actual-location provision. It says state officials may continue enforcing the other sections of the law. The injunction is preliminary, so it suspends enforcement of that clause during the litigation rather than finally striking it down.
The challenge was brought by Aylo Freesites and its parent company, which operate adult platforms including Pornhub. Utah’s 2026 amendment said a visitor physically in the state counts as a Utah user even if a VPN or proxy disguises the visitor’s location. Aylo argued that a site cannot identify every such user with certainty and could therefore be forced to check the ages of visitors outside Utah as well.
Utah told the court that reasonable detection methods could identify likely VPN use and infer a visitor’s location from other signals, such as device settings and account activity. Barlow found that the actual-location clause lacked a reasonable-efforts qualification. Because the parties agreed that perfect geolocation is not possible, he concluded that Aylo was likely to succeed on its claim that the clause would impermissibly burden commerce beyond Utah’s borders.
The court also found that Aylo had shown irreparable harm and that the balance of equities favored an injunction. It did not decide the merits of the entire age-verification statute. Utah had agreed not to enforce the VPN-related provision while the court considered the preliminary-injunction request.
The dispute turns on the distinction between checking the age of a user known to be in Utah and detecting every Utah resident who has concealed that location. Other age-assurance disputes have centered on whether the chosen method effectively keeps minors from adult sites. In the UK, for example, Ofcom is examining Pornhub’s reliance on Apple’s device-level age assurance. The Utah order instead addresses how far a state’s location rule can reach when geolocation tools are imperfect.
Sources: U.S. District Court order, U.S. District Court memorandum
–
By the ID Tech Editorial Team
