TL;DR
Get privacy and security gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A federal judge issued a preliminary injunction blocking enforcement of Utah SB 73’s VPN provisions while a legal challenge proceeds. The court found the law likely requires covered websites to determine every visitor’s physical location with a level of accuracy that current technology cannot provide. The order concerns the VPN provisions, not necessarily every part of the law.
A federal judge has blocked enforcement of Utah’s SB 73 VPN provisions, finding that the law likely requires covered websites to determine the physical location of users with a precision that current geolocation technology cannot provide. The preliminary injunction, sought by Aylo, the parent company of Pornhub and other adult websites, pauses those provisions while the constitutional challenge continues.
SB 73 requires covered adult websites to address visitors who use VPNs or similar tools that obscure their network location. Under the law’s framework, sites must either identify users’ actual locations and block those in Utah, or verify visitors’ ages in case they are accessing the site from the state. The law also bars covered sites from providing information about using VPNs to bypass age checks; Aylo’s lawsuit does not challenge that separate provision, according to the Electronic Frontier Foundation (EFF).
In granting preliminary relief, Judge Barlow said the law likely places sites at risk of liability unless they can identify users’ locations with near-perfect accuracy. The judge wrote that the statute “essentially imposes strict liability” on entities such as Aylo and “requires entities like Aylo to geolocate its website users with perfection.” The court also recognized that “geolocation perfection is not presently possible.”
The court’s order follows a challenge brought by Aylo after SB 73 was signed into law earlier in 2026. Utah and Aylo had agreed to pause enforcement while the court considered the injunction request or until compliance rules were finalized. The state’s proposed rules were published September 1, and EFF submitted comments opposing them. EFF says the judge’s order prevents enforcement of the VPN provisions pending further court action.
The Cost of Location-Based Enforcement
The ruling addresses a practical problem at the center of the law: a website generally sees the IP address of a VPN server, not the user’s underlying network location. VPNs route traffic through intermediary servers, so a site may not be able to tell whether a connection ultimately comes from Utah or somewhere else. The court’s reasoning means the state cannot, for now, enforce these provisions against covered sites while the case proceeds.
The potential effects extend beyond Utah. EFF argues that a requirement to account for every visitor could push platforms to verify the age or location of users nationwide, block VPN connections broadly, or restrict access from Utah. Those are possible compliance responses described by EFF, not findings that every website has adopted them. The dispute matters to users because age-verification systems and attempts to detect location-masking tools can affect privacy, access, and the reliability of online services.
privacy-focused VPN router
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How SB 73 Reached Federal Court
Utah enacted SB 73 earlier in 2026, with the law initially scheduled to take effect in May. Aylo filed a constitutional challenge, and the state agreed to hold off on enforcement while the court reviewed the request for preliminary relief or until administrative rules established compliance terms. The injunction now pauses the challenged VPN provisions pending further action; it is not a final decision on the full lawsuit.
Utah’s Department of Commerce published proposed rules, identified as R152-78B, on September 1. The proposal called for “commercially reasonable geolocation obfuscation detection systems,” according to EFF’s account of the rulemaking. EFF submitted comments arguing that suggested indicators, such as connection latency and device time zones, are unreliable and could lead to mistaken classifications. Those concerns are EFF’s position; the court ruling described in the source material rests on the law’s location and compliance demands.
““Geolocation perfection is not presently possible.””
— Judge Barlow, as quoted in the court’s ruling
Limits of the Court Order
The injunction is preliminary, not a final ruling that SB 73 is unconstitutional. The lawsuit remains unresolved, and the source material does not provide the full order’s duration, any appeal plans, or a schedule for the next court proceedings. The ruling described here blocks the law’s VPN provisions; it does not establish that all requirements in SB 73 are suspended.
It is also unclear how Utah’s Department of Commerce will respond to the injunction or whether the proposed administrative rules will be revised. EFF says the order prevents enforcement while the court considers further action. The reach of any later ruling, including whether it addresses other provisions or applies beyond the parties, remains to be determined.
The Case and Rules Proceed
The constitutional case will continue in federal court, where the judge may consider further arguments before deciding whether to issue a lasting remedy. Utah may also respond to the injunction and the dispute over the proposed compliance rules. Until the court takes further action, the VPN provisions covered by the order cannot be enforced, according to EFF’s report.
The next developments to watch are any appeal, additional court orders, and changes to R152-78B or the state’s enforcement approach. The source material does not identify a date for a next hearing or a final decision.
Key Questions
What did the judge block?
The preliminary injunction blocks enforcement of SB 73’s VPN provisions while the legal challenge proceeds. The source material does not say that every part of the law has been halted.
Why did the court find the VPN requirements problematic?
The judge said the law appears to require websites to locate users with near-perfect accuracy, even though perfect geolocation is not presently possible. VPNs can obscure a user’s location by routing traffic through another server.
Does the ruling end Utah’s age-verification law?
No. It is a preliminary injunction involving the VPN provisions, not a final decision on the entire law or the underlying constitutional lawsuit.
What happens to the proposed Utah rules?
The Department of Commerce published proposed compliance rules on September 1, and EFF submitted objections. The source material does not say whether the state will revise or withdraw those rules after the court order.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
