Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility

Listen to this article

Narrated by Charlotte · The Noble House

A federal court has done something legislators rarely invite: it read a statute for what its words demand rather than for what its defenders say they intend. On September 24, 2026, U.S. District Judge David Barlow granted Aylo, the parent company of Pornhub, a preliminary injunction against the VPN provisions of Utah's SB 73 [2][3]. The reasoning is narrow. It matters because it is precise. The court did not say states cannot require age verification. It said Utah wrote a rule that no website can obey.

What the Court Did

The verified events are simple. Judge Barlow of the District of Utah granted a preliminary injunction in favor of Aylo [3]. The order blocks enforcement of the provision aimed at people who use VPNs to hide their location [2]. He found Aylo likely to succeed on its argument that the provision violates the dormant Commerce Clause, the doctrine that limits states from imposing excessive burdens on interstate commerce [2][8]. He also found that enforcement would cause irreparable harm to Aylo [8].

The decision rests on two linked findings. First, the statute requires companies like Aylo to "geolocate its website users with perfection to avoid liability" [2][4]. Second, the court acknowledged "that geolocation perfection is not presently possible" [1]. KPCW reports that the judge treated it as "undisputed" that technology capable of perfect geolocation does not exist yet [4]. Biometric Update describes the result as an actual-location requirement that effectively imposes strict liability on adult sites [6].

The injunction is limited. It blocks only the new provision targeting users who hide their location, and Utah's broader age-verification law remains in effect while the lawsuit proceeds [2]. KPCW notes that the state had already agreed not to enforce the rule pending the judge's ruling [4].

Compass Predictive Analytics

Compass prediction

Forecast

No · Against

Will "Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility" produce verified policy implementation within 72h? Horizon 72h; target window 2026-10-02T01:35:54.745000+00:00 to 2026-10-05T01:35:54.745000+00:00.

Signal gauge

61%

Evidence Reliability

6 Of 6 Validated Assertions Have Complete Exact Span And Ownership Lineage. · Positive

tracked

Quantifies the conservative evidence floor after exact-span and independent-owner checks.

6 evidence references

Editorial illustration of the preliminary injunction pausing Utah's VPN location rule while baseline age verification remains in effect. — What the Court Did The verified events are simple.

What SB 73 Asked of Websites

Utah has required adult sites to use age verification since 2023 [2]. Such laws typically ask users to prove their age with a government ID or through a third-party service [2]. The practical weakness is well known. A VPN routes a user's traffic through another location, so someone in Utah can appear to connect from another state or country [2].

SB 73, known as the Online Age Verification Amendments, took effect in May to close that gap [2]. One account gives the effective date as May 6, 2026 [9]. Its central provision says a person is considered to be accessing a website from Utah if they are physically located in the state, regardless of whether they use a VPN or any other method to hide their location [2]. Aylo calls this the "Deemed-Location Provision," and one account reports exposure to fines of up to $2,500 per violation [10].

The 2026 update did more. KPCW reports that it bans adult content websites from sharing instructions on getting and using a VPN, which raised First Amendment concerns among digital rights advocates, and that it created a 2% tax on transactions made on pornography websites [4]. EFF adds that Utah was, to its knowledge, the first state to target the use of VPNs to avoid legally mandated age-verification gates [1]. EFF also notes that Aylo's lawsuit does not challenge the provision prohibiting covered websites from sharing information about VPNs [1]. That means the court's holding concerns location duties, not the speech restriction.

The state's reasoning was not frivolous. One analysis of the case gives Utah's side a fair hearing: if a check is trivially defeated by a teenager connecting through a VPN, lawmakers have reason to want VPN traffic covered [9]. Another account notes that when Pornhub blocked Texas addresses after that state's law, VPN demand in Texas reportedly surged [10]. Utah's own experience looks similar. Some sites, including Pornhub, chose to block the whole state rather than comply, and Utah then saw a spike in Google searches for how to get a VPN [4]. The goal was sound. The mechanism was the flaw.

Compass Predictive Analytics

Signal gauge

98%

Evidence Freshness

Evidence Freshness Is 98 For The Selected Signal. · Positive

tracked

Separates current evidence from aging context using a declared decay window.

6 evidence references

Signal gauge

100%

Independent Source Breadth

Independent Source Breadth Is 100 For The Selected Signal. · Positive

tracked

Shows how many genuinely independent owners support the evidence after syndication collapse.

6 evidence references

Conceptual diagram showing a Utah user connecting through a VPN relay to a website that cannot reliably determine the user's real location. — What SB 73 Asked of Websites Utah has required adult sites to use age verification since 2023.

Why Perfection Was the Crux

The central dispute was whether the statute demanded perfection or only effort. Utah Attorney General Derek Brown's office argued that the statute does not require perfection, but rather reasonable efforts to determine which users are actually located in Utah [2][4]. Judge Barlow was not persuaded. He wrote that the court must "analyze the statutory text the Legislature passed into law, not just the Attorney General's proposed enforcement of it" [2][4]. In his words, quoted by EFF, the statute "now essentially imposes strict liability for entities like it when it comes to determining the location of its websites' users" [1].

This is the hinge of the case, and the reasoning is conventional. A prosecutor's promise of restraint is not a legal limit. A company deciding how to operate has to plan around what the law says it can be punished for. Under the text as written, a single Utah user who slips through behind a VPN is a violation.

The engineering explains why. EFF describes how VPNs route web traffic through intermediary servers, so a destination website sees only the IP address of the VPN server and has no reliable mechanism to tell whether a connection originates from Salt Lake City, Seattle, or Shanghai [1]. The EFF and Aylo both argued that, because no one can determine every internet user's physical location with certainty, the law could force sites to age-verify users worldwide to make sure none are in Utah [2]. EFF's phrasing of the choice is that sites would have to "ban all known VPN IPs, or to mandate age verification for every visitor globally" [2]. Another observer called the compliance problem "an unresolvable compliance paradox" [10].

Compass Predictive Analytics

Signal gauge

82%

Observed Source Diffusion

61 Observed Sources Resolve To 29.344481 Effective Sources. · Neutral

tracked

Separates broad source participation from concentration in a few high-volume sources.

6 evidence references

Analytic module

module

Signal Pressure Matrix

Validated independent claim-owner cells resolve to 6 support and 0 risk pressure.

6 evidence references

Why Perfection Was the Crux The central dispute was whether the statute demanded perfection or only effort.

The Constitutional Reasoning

The dormant Commerce Clause holding follows from that technical premise. The court wrote that the law's actual-location provision "in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating" [1]. Judge Barlow put the consequence in concrete terms: because the law requires perfection in the absence of perfect geolocation tools, Aylo would need to verify 28 million users, whether located in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu, to ensure compliance and avoid liability [1].

That is a burden on people and businesses outside Utah's borders. EFF reads the court as holding that Utah has less burdensome ways to prevent Utah minors from reaching adult websites than requiring all users in the world to comply with SB 73 [1]. Note the posture: this is a likelihood-of-success finding at the preliminary stage, not a final judgment. KPCW reports the law will remain enjoined until a judge rules on its constitutionality [4].

Analysis. The Commerce Clause theory is doing quiet work here. The court did not need to decide whether Utah may protect minors, which it plainly may try to do. It needed only to decide whether Utah may do so by a method whose practical effect is to export Utah's rule to the rest of the country and the world. By framing the problem as extraterritorial burden, the ruling separates two questions that often get blurred: whether age verification is permissible, and whether a particular state's mechanism for enforcing it can be technically met without regulating non-residents. One commentary reaches the same reading, arguing the ruling "targets a drafting flaw, not age checks as such" [9]. That commentary also notes that the Supreme Court upheld Texas's age-verification law under intermediate scrutiny in Free Speech Coalition v. Paxton in 2025 [9][10]. The Utah ruling does not disturb that holding, and nothing in the reported opinion suggests it tries to.

Compass Predictive Analytics

Analytic module

module

Evidence Density

6 source links, 6 exact spans, and 6 independent owners support this signal.

12 evidence references

Analytic module

module

Cross Pressure

Support and risk pressure differ by 100 points.

6 evidence references

The Constitutional Reasoning The dormant Commerce Clause holding follows from that technical premise.

The Rulemaking Behind the Statute

The statute was not the only moving part. According to EFF, Utah and Aylo initially agreed that the state would pause enforcement while the court considered the preliminary injunction request or until administrative rules setting specific compliance terms were finalized [1]. Proposed rules (R152-78B) were published by the Utah Department of Commerce's Division of Consumer Protection on September 1, and according to the notice they could take effect as soon as October 8, 2026 [1]. An earlier account, published in June, gave September 3 as the date the pause would end [10]. EFF says Judge Barlow's decision means the rules cannot be enforced pending further action by the court [1].

EFF's comments describe the proposed rules as compelling commercial entities to implement "commercially reasonable geolocation obfuscation detection systems," which it argues demands a technical impossibility [1]. The group also contends that the suggested detection heuristics, such as monitoring connection latency or device time zones, are notoriously unreliable and easily skewed by normal network conditions, which it says would lead to misclassification, unwarranted access blocks, and privacy impacts beyond Utah's borders [1]. These are EFF's arguments, offered in a regulatory comment, not findings of the court.

Analysis. The rulemaking shows the state's likely escape route and its limits. A "commercially reasonable" standard sounds like the reasonableness the Attorney General defended in court. But the judge held that the court must analyze the statutory text the Legislature passed into law, not just the Attorney General's proposed enforcement of it. As the court read that text, liability attaches even if a single Utah user goes undetected.

Compass Predictive Analytics

Analytic module

module

Statistical Surprise

The current share has a modified-Z score of -0.592918 and is classified within reference range.

6 evidence references

What Remains Standing, and What Comes Next

The verified position is straightforward. The general age-verification regime stays in force [2]. The VPN location provision is enjoined [2][7]. The litigation continues [4].

Analysis. The practical result is that the VPN loophole remains open pending further litigation. That is an inference, not a holding, but it follows directly from the scope of the injunction. People in Utah can continue to use VPNs for now, as KPCW put it [4], and sites that block the state outright, as Pornhub did after the 2023 law, face no new duty to detect them [4].

EFF reports that Utah legislators have indicated they may attempt to revise the law during the next legislative session [1]. That is the most important open variable. A revision could drop the demand for perfection and replace it with a reasonableness standard. One commentator suggests a reasonableness standard with a safe harbor for operators, rather than strict liability for VPN circumvention, as the constitutionally safer drafting path [9]. That is a policy proposal from a commentator, not a ruling. Still, the court's own logic points in the same direction, since its objection was to strict liability for an outcome no technology can deliver [1][6].

EFF also calls the injunction an important precedent for other states weighing similar anti-VPN proposals [1]. That judgment should be held at its proper size. A preliminary injunction from a single district court binds no other state and may be revisited on a fuller record. Its persuasive weight depends on how other courts receive the reasoning. What can be said is that the opinion supplies a ready template for challengers: show that the statute converts uncertainty about location into strict liability, and the burden on out-of-state users follows.

Compass Predictive Analytics

Analytic module

module

Observed Source Diffusion

61 sources produce 29.344481 effective-source breadth with HHI 0.05486.

6 evidence references

The Speech and Privacy Questions Left Open

Two issues sit just outside the holding. The first is the ban on sharing VPN instructions. Because Aylo's suit does not challenge it, the injunction does not reach it [1]. Digital rights advocates raised First Amendment concerns about that ban [4], and one commentator argues that information about a lawful privacy tool is protected speech [9]. Those views are arguments, and no court has ruled on them in this case.

The second is privacy. EFF argues that SB 73 answers users' efforts to avoid invasive data collection with greater surveillance of their online activity [1]. Another analysis contends that mandating VPN detection pushes platforms toward traffic surveillance infrastructure instead of privacy-preserving age assurance [10]. Whether or not one accepts those policy conclusions, the court's finding supplies their factual footing: if reliable detection does not exist, then any detection regime will misclassify some users, and the only sure way to avoid liability is to verify everyone.

Judgment

The ruling is right on the question it answered. Utah told websites to find every Utah resident, including those who have deliberately concealed themselves, and attached liability to each miss. The court found, on an undisputed technical premise, that this cannot be done and that the only way to approximate compliance is to impose Utah's verification demand on the whole world [1][4]. That is a defect in the law's design, and the Attorney General's assurance of reasonable enforcement could not repair it [2].

The decision is also limited, and it should be read that way. It is preliminary. It leaves Utah's baseline age verification in place [2]. It leaves the VPN-instructions ban unexamined [1]. It leaves the state free to try again with a standard that asks for effort rather than perfection.

My assessment, offered as analysis: Utah's VPN location mandate is unlikely to survive in its current form. A statute that makes strict liability depend on a capability that does not exist is open to the same objection the court accepted at this preliminary stage. The durable lesson for other legislatures is that the interest in protecting minors and the limits of internet technology are both real, and a law that ignores the second will lose the first its day in court. States that want to close the VPN gap will have to write standards that operators can meet, because the courts, as this one did, will read the words as written.

Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility

What the Court Did

What SB 73 Asked of Websites