TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A federal judge issued a preliminary injunction blocking enforcement of parts of Utah’s SB 73 that target VPN use on adult websites. The ruling says the law likely places an unconstitutional burden on people and businesses outside Utah and requires geolocation accuracy that is not presently possible. The wider legal challenge is ongoing.
A federal judge has temporarily blocked enforcement of Utah’s SB 73 VPN provisions, finding that the law likely burdens people and businesses beyond the state and demands a level of user-location accuracy that current technology cannot provide. The injunction, described in a report by the Electronic Frontier Foundation (EFF), applies while a lawsuit by Aylo, the parent company of Pornhub and other adult websites, continues.
SB 73 requires covered adult websites to address VPN use by either determining users’ physical locations and blocking Utah visitors or applying age verification more broadly. The law also bars covered websites from providing instructions on using a VPN to get around the checks. Utah’s federal court halted the law’s VPN-related requirements last week, according to EFF; the ruling is preliminary, not a final decision on the case.
Judge Barlow said the law effectively exposes companies such as Aylo to liability unless they can determine users’ locations with perfection. The court recognized that perfect geolocation is not presently possible. VPNs route traffic through intermediary servers, so a site generally sees the server’s IP address rather than a reliable indication of the user’s physical location. EFF says the resulting compliance options could include blocking VPN traffic nationwide or withdrawing access in Utah.
The court also reasoned that the statute’s location requirement could force websites to verify every visitor’s age, including users outside Utah, because a site could face liability if a visitor masking their location were in the state. EFF says the ruling recognizes that Utah has less burdensome ways to protect minors than imposing requirements affecting users across the country. The injunction does not resolve every provision of SB 73: EFF says Aylo’s lawsuit does not challenge the separate ban on covered websites sharing information about VPNs.
Why the VPN provisions were blocked
The ruling matters because it limits, for now, how Utah can enforce a state internet law whose requirements may reach websites and users outside its borders. The court’s preliminary view is that the law’s location rules impose a burden beyond Utah, in part because a website may have to treat every visitor as a potential Utah user to avoid liability.
There is also a practical privacy issue. EFF argues that requiring websites to identify or flag VPN use would encourage broader monitoring of connections and could lead to users being incorrectly classified or blocked. Those outcomes are EFF’s concerns, not findings that the court has established in this order. The judge’s stated concern, as described by EFF, is that the law requires geolocation perfection despite the current limits of the technology.
For readers, the case is a test of whether states can use liability rules to make online services identify users who deliberately mask their network location. The injunction pauses the challenged requirements in Utah while the court weighs the constitutional dispute; it does not establish a nationwide rule about age verification or VPNs.
As an affiliate, we earn on qualifying purchases.
How SB 73 reached the court
Utah enacted SB 73 earlier in 2026, with the law initially scheduled to take effect in May. Aylo filed a constitutional challenge, and the state and company initially agreed to pause enforcement while the court considered a preliminary injunction request or while administrative compliance rules were finalized.
The Utah Department of Commerce’s Division of Consumer Protection published proposed rules, identified as R152-78B, on September 1. The notice said the rules could take effect as soon as October 8, 2026. EFF submitted comments opposing them, arguing that the proposed requirement for “commercially reasonable geolocation obfuscation detection systems” would be technically unreliable and would expand data collection. Those are EFF’s positions in its comments, rather than court findings.
The injunction now prevents enforcement of the law’s VPN provisions pending further action by the court, according to EFF’s account of the order. The legal challenge is still at an early stage: a preliminary injunction is an interim measure, and the judge has not issued a final ruling on the lawsuit.
““Because the law requires perfection in the absence of perfect geolocation tools, Aylo would need to verify those 28 million users.””
— Electronic Frontier Foundation
VPN compatible routers for home use
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Questions still before the court
The injunction is preliminary, and the lawsuit has not been decided. The available report does not provide a full schedule for the next court hearings or say when Judge Barlow might issue a final ruling. The scope and duration of the pause could change as the case proceeds.
It is also not clear from EFF’s report how the state will respond to the injunction or whether it will revise its approach. The proposed administrative rules and their possible October 8 effective date were part of the regulatory process, but the injunction means the challenged VPN requirements cannot be enforced pending further court action, according to EFF.
Some of the broader claims about surveillance, inaccurate detection methods, and effects on users are EFF’s arguments in its comments to the Department of Commerce. The court’s preliminary ruling, as summarized by EFF, addresses the burdens and technical demands of the statute; it does not establish that every proposed detection method will produce the harms EFF describes.
As an affiliate, we earn on qualifying purchases.
Next steps in Utah’s case
The case will continue in federal court, where Aylo’s constitutional challenge remains unresolved. The judge may consider further filings and arguments before deciding whether the challenged provisions can ultimately stand. No final hearing or decision date is specified in EFF’s report.
Utah’s Department of Commerce may also need to address how the injunction affects the proposed rules for implementing SB 73. EFF says it has submitted formal comments opposing those rules. Until the court takes further action, the immediate status is that the law’s VPN provisions are blocked from enforcement, while the separate provision about sharing VPN instructions is not part of Aylo’s challenge as described by EFF.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the judge order?
The judge issued a preliminary injunction blocking enforcement of SB 73’s VPN-related provisions while Aylo’s lawsuit proceeds. It is an interim order, not a final ruling that the law is unconstitutional.
What does Utah’s SB 73 require of adult websites?
The law requires covered sites to address VPN use by locating and blocking Utah visitors or applying age verification more broadly. It also includes a separate ban on sharing instructions for using VPNs to bypass checks.
Why did the court question the location requirement?
VPNs route traffic through intermediary servers, so a website may see the server’s location rather than the visitor’s physical location. The judge said perfect geolocation is not presently possible, yet the law could expose sites to liability if they fail to identify a Utah user.
Does the injunction cover every part of SB 73?
EFF says Aylo’s lawsuit does not challenge the law’s provision barring covered websites from sharing VPN information. The reported injunction concerns the law’s VPN-related enforcement requirements; the report does not describe a final ruling on the statute as a whole.
What happens next?
The federal case will continue, and the court may take further action after considering additional arguments. The timing of a final decision is not specified in EFF’s report.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
