Utah Agrees Not to Enforce Its VPN Age-Verification Law While Court Weighs Injunction

Utah will not enforce the first US law to write virtual private networks into an age-verification regime, after the state Department of Commerce and the owner of Pornhub filed a joint stipulation pausing the measure.

The law took effect this week. Under the agreement, the department will hold off enforcing it until US District Court Judge David Barlow rules on an injunction request, or until administrative rules setting out exactly what adult sites must do to comply are finalised.

Aylo Freesites, which operates several of the largest adult websites including Pornhub, brought the challenge. It argues the law exposes any website hosting adult content to civil or criminal liability. Barlow has not ruled on the injunction request and said at a hearing that he could not commit to when he would.

In exchange for the pause, Aylo agreed to keep its existing geofencing in place. The company has blocked Utah IP addresses in protest at the state legislature’s age-verification bills, so its sites remain unavailable in Utah regardless of the enforcement position.

What distinguishes the Utah statute from other state age-verification laws is how it handles circumvention. It provides that anyone physically in the state is considered to be accessing a website from Utah, whether or not they are using a VPN. It also bars operators hosting a substantial portion of material harmful to minors from facilitating or encouraging VPN use.

VPN providers are the target of that language, and major operators have publicly refused to change their products to comply.

Utah passed the measure as Senate Bill 73. The Department of Commerce is the enforcing agency, and the administrative rules referenced in the stipulation would set the specific compliance terms that adult sites must meet, which do not yet exist in final form.

Aylo has consistently said it does not oppose age verification in principle, but that US implementations create substantial risk of identity theft and other privacy harms.

Other states have taken different routes, with Missouri codifying an attorney general rule into statute and California placing the duty on operating systems.

Sources: The Salt Lake Tribune, Engadget, TechRadar

–

By Ali Nassar-Smith