Utah's VPN Clause Is Blocked, for Now: What the Aylo Injunction Changes and What It Does Not

Update, October 6, 2026: the ruling this article was waiting for has arrived, a month early. On September 24, Judge David Barlow of the US District Court for the District of Utah granted Aylo’s motion for a preliminary injunction against the deemed-location clause, the part of SB 73 that counted a VPN user physically in Utah as a Utah visitor no matter what IP address a site saw. His reasoning fits in two of his own sentences: the amendment “requires entities like Aylo to geolocate its website users with perfection to avoid liability,” and “it is undisputed that geolocation perfection is not presently possible.”

The injunction is narrower than most write-ups suggest, and the dates that mattered in September no longer matter at all. This article has been updated throughout: what the judge blocked, what he refused to block, what is still in force in Utah today, and what the state’s 95% detection rule was going to ask of websites.

When this piece first ran on September 3, the news was a date that meant less than the headlines claimed. Gizmodo and others reported that the first US law targeting VPN use would take effect that day. In fact SB 73 had been in force since May 6, 2026, and September 3 was only the expiry of a courtroom truce: a promise by Utah not to enforce the VPN clause against one company, Aylo, the operator of Pornhub, while the judge weighed the company’s challenge. That truce was extended on August 27 and ended the moment the ruling landed.

Here is what the bill says, whom it binds, what the court decided, and what any of it means for a person who uses a VPN.

Did Utah's VPN Law Take Effect on September 3?

No. The confusion comes from conflating two documents.

The first is the law itself. SB 73, the Online Age Verification Amendments, was sponsored by Senator Calvin Musselman and Representative Steve Eliason and signed by Governor Spencer Cox on March 19, 2026. Section 22 of the enrolled bill sets its effective date: May 6, 2026, with a handful of tax provisions following on October 1. The VPN language sits in Section 14, which amends Utah Code 78B-3-1002, and it carries the May 6 date like everything else.

The second document is a joint stipulation filed in federal court on April 27, 2026, five days after Aylo sued. In it, the Utah Division of Consumer Protection and the Utah Department of Commerce agreed to forbear enforcement of the “Deemed-Location Provision” against Aylo and its affiliates “until September 3, 2026, which is 120 days after the provision was otherwise scheduled to take effect.” Aylo, for its part, agreed not to change its current geofencing in Utah, meaning Pornhub and its sister sites would stay blocked for Utah IP addresses, as they have been since 2023.

That is where the September 3 date comes from. It was never an effective date. It was the expiry of a non-enforcement promise made to one litigant. And per the court docket, on August 27 the parties filed a further “Joint Stipulation for Extension of Non-Enforcement,” which the court acknowledged the next day. As XBIZ reported on August 28, the extension runs to October 22, 2026, or until the court decides Aylo’s motion for a preliminary injunction, whichever comes first. The stipulation frames the extra time around a Utah rulemaking: “this Period of Continued Forbearance allows Plaintiffs to participate in that rulemaking process without the threat of liability in the interim.”

So the accurate sentence was longer than a headline allows. The VPN clause became law in May, applied on paper to every covered website except Aylo, and was never, as far as the public record shows, enforced against anyone over VPN traffic. Since September 24 it is preliminarily enjoined. The order grants the injunction on the provision itself, without limiting its terms to the plaintiffs, and the Electronic Frontier Foundation reads it as taking the clause off the table while the injunction stands.

What Does SB 73 Actually Require, and From Whom?

Utah has required age verification on adult sites since 2023. SB 73 rebuilds that regime: it adds public enforcement by the Division of Consumer Protection alongside the existing private right to sue, adds fines, creates an excise tax on covered sites, and adds two paragraphs about VPNs. Those two paragraphs, in the enrolled text, read as follows.

The deemed-location rule, new subsection (3) of 78B-3-1002: “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”

The facilitation ban, new subsection (4): a covered site “may not facilitate or encourage the use of a virtual private network, proxy server, or other means to circumvent age verification requirements,” including by providing “instructions on how to use a virtual private network or proxy server to access the website” or “means for individuals in this state to circumvent geofencing or blocking.”

Both rules are addressed to a “commercial entity that operates a website that contains a substantial portion of material harmful to minors.” Substantial portion has a number: more than 33 1/3 percent of the total material on the site. A site that brands itself as primarily adult, or uses an adult-themed domain, is presumed to cross that line.

The penalties are aimed at the same entity. Under new section 78B-3-1004, the Division’s director may impose an administrative fine of up to $2,500 for each violation, and a court can add a civil penalty of up to $2,500 per violation, disgorgement, injunctions and actual damages, plus up to $5,000 per violation for ignoring an order. Section 78B-3-1002(6) exempts internet service providers, search engines and cloud providers for merely carrying traffic, and subsection (5) exempts bona fide news and public-interest content.

Notice what is absent. There is no definition of “VPN user,” no duty imposed on a VPN provider, and no fine, offense or civil liability for an individual who connects through a VPN. The quotable version: Utah’s SB 73 does not regulate VPN users; it regulates websites, by declaring that a visitor physically in Utah counts as a Utah visitor no matter what IP address the site sees.

Is It Illegal to Use a VPN in Utah Now?

No, and it was not on May 6 either. Every operative clause of SB 73 names a commercial entity as the party with the obligation. A resident of Salt Lake City who turns on a VPN to use hotel Wi-Fi, reach a work network, keep an ISP from profiling their browsing, or watch a home subscription while traveling has done nothing the statute addresses.

What the law changes is the website’s exposure. Before SB 73, a covered site could argue that a visitor arriving from a Dutch or Canadian IP address was, for its purposes, in the Netherlands or Canada. Now Utah says the site is on the hook if that visitor was actually in Utah. Whether the site can know that is the next question, and it is the whole case.

How Is a Website Supposed to Know You Are in Utah If You Use a VPN?

It largely cannot, which is why the criticism of SB 73 comes from very different corners.

The Electronic Frontier Foundation called blocking VPN addresses “a technical whack-a-mole that likely no company can win”, noting that VPN providers add addresses constantly and no complete blocklist exists. Quoted by KUER in May, Fight for the Future’s Lia Holland put it more bluntly: determining where a user of a reputable VPN is browsing from is “literally impossible by design.” NordVPN, asked by Gizmodo, described the statute as a “liability trap” in which “platforms face real financial exposure for failing at a technical task no one currently knows how to perform reliably.”

The technical reasons are not controversial. IP geolocation is a commercial inference drawn from routing data and registration records, not a measurement of where a device sits, and it is routinely wrong at the state level even for ordinary connections. VPN and proxy detection relies on lists of known exit addresses that lag behind reality. And the same signals that flag a consumer VPN also flag corporate networks, university networks, mobile carriers that route traffic through out-of-state gateways, and privacy features built into mainstream browsers. A site that blocks everything that looks like a VPN blocks a large share of legitimate visitors, in Utah and everywhere else.

That is Aylo’s argument in a sentence: the only way to be sure of compliance in Utah is to verify the age of everyone, everywhere, which the company told the court would drive away up to 80 percent of its customers, or to block anyone who might conceivably be in Utah. Senator Musselman’s response, quoted by KUER, is that “SB 73 is about accountability,” and that sites can verify age or confirm location “while still preserving the encryption options for users.”

The court has now recorded how far that dispute actually goes, which is: not far. From the order: “The law requires geolocation perfection, but the parties agree that current technological advancements do not allow an entity to perfectly (1) detect VPN/proxy users, or (2) geolocate where all of those VPN/proxy users are accessing the site from.” Utah and Aylo fought over everything else in this case. Not over that.

Utah’s own answer was arriving through rulemaking, and the text is now public. The Division’s proposed rule, R152-78B, published in the Utah State Bulletin on September 1, defines “geolocation obfuscation” as a VPN, proxy server or other technology that masks a device’s location, and spells out what “commercially reasonable” detection means: a system calculated to identify with at least 95% accuracy whether a visitor is in Utah, next to a separate 95% standard for telling whether a visitor is a minor. Sites may analyze “latent signals,” and the rule names two: connection latency and the device’s or browser’s time zone setting. A visitor flagged as obfuscating gets a three-option menu: share their device location to confirm they are not in Utah, disable the obfuscation and verify their age if they are, or simply verify their age. The Division’s own cost estimates run from $0.01 to $0.12 per age check and about a cent per visitor for location screening.

Read that against the ruling and the timing becomes the story. The statute, as written, demanded perfection; the rule that was supposed to soften perfection into a 95% target reached the court too late. Footnote 73 of the order says so flatly: because the proposed rule came after briefing and oral argument, “the court does not consider it here.” The comment period closed on October 1, with the EFF filing in opposition. The bulletin lists October 8 as the earliest date the rule may become effective, no notice making it effective had appeared as of this update, and its location provisions now implement a clause a federal court has enjoined.

What Did Judge Barlow Rule on September 24?

Aylo Freesites and Aylo Group filed suit on April 22, 2026, in the US District Court for the District of Utah, case 2:26-cv-00340, against the Division of Consumer Protection, its director Katie Hass, the Department of Commerce and its executive director Margaret Busse. The case is before Judge David Barlow. The complaint targets the deemed-location provision specifically and argues, per Deseret News, that the clause “transforms what is nominally a Utah regulation into a de facto global mandate,” in violation of the Constitution’s limits on state regulation of interstate and foreign commerce.

Aylo is not challenging age verification as such. The Supreme Court settled that question in June 2025 in Free Speech Coalition v. Paxton, upholding Texas’s age-verification law. Aylo’s claim is narrower: a state may require age checks for its residents, but it cannot make a foreign company liable for visitors it has no reliable way to place inside the state.

On September 24, 2026, that narrower claim won, on one of its two theories. In a 40-page memorandum decision, Judge Barlow held that the deemed-location clause likely violates the dormant Commerce Clause, the constitutional limit on states regulating commerce beyond their borders, both as a direct regulation of out-of-state conduct under the Tenth Circuit’s ACLU v. Johnson line and under the Pike balancing test. The court’s illustration is the one worth remembering: Aylo has roughly 28 million monthly US visitors, and because the statute demands certainty no tool can deliver, the only safe course would be to verify all of them, whether they sit in Salt Lake City or Honolulu. A Utah statute that forces a company to treat every American as a possible Utahn is, the court concluded, regulating the nation.

Utah’s attorney general had argued the state would only ever demand reasonable geolocation efforts, not perfect ones. The court took that as sincere and legally beside the point: the statute contains no reasonableness qualifier, reading one in would require “rewriting, not just reinterpretation,” and the court must judge the text the legislature passed, not the enforcement policy the attorney general proposes. Aylo, for its part, told the court that if the law were written the way the attorney general defends it, “we would not be here.” That exchange is the clearest map of what happens next: a one-word legislative fix, some form of “reasonable,” would likely end the fight.

The ruling is not a clean sweep, and most coverage flattened this. Judge Barlow rejected Aylo’s separate claim that the clause is impermissibly extraterritorial legislation, declined to reach the Foreign Commerce Clause, and refused Aylo’s request to also enjoin the general age-verification duty for visitors who appear to be outside Utah: “This relief cannot be granted.” The injunction is preliminary, not a final judgment, and it covers one subsection of one statute.

One more passage deserves quoting, because federal courts do not often say it this plainly. In its background section, the order notes that VPNs and location-privacy tools have “entirely legitimate purposes,” and lists them: securing communications on public networks, preventing websites from harvesting personal data, and circumventing censorship by oppressive governments. That sentence now sits in the public record of the first US case about a VPN-naming statute.

The timeline, from the docket and the parties’ filings:

What Is Actually in Force in Utah Today?

This is the question the headlines answer worst, so here it is provision by provision, as of this update:

Two things follow from that table. For a person with a VPN, the ruling changes nothing, because nothing in the statute ever applied to them. For covered websites, the enforceable obligations today are the same age-verification duties that exist in roughly half the country, minus the one clause that made Utah unique. Whether Aylo will now lift its voluntary block of Utah, in place since 2023, is a business decision the company has not announced; the stipulation that froze its geofencing ended with the ruling.

Which Other States Are Copying Utah's Approach?

Age verification for adult sites is now the norm in the United States. The Age Verification Providers Association counted at least 25 states that had passed such laws as of February 2026, and trackers updated over the summer put the number higher still. Utah was the second state in, with a law that took effect on May 3, 2023 and prompted Pornhub to block the entire state two days earlier. Google Trends showed VPN searches in Utah spiking to peak popularity in the early hours of May 2, 2023, as Newsweek reported at the time. That episode, more than anything, explains why the 2026 bill mentions VPNs at all.

Copying the VPN clause is another matter, and the September 24 ruling just made it harder to recommend. Legislators in Michigan proposed going much further in 2025 with a bill that would have required ISPs to block VPN traffic outright; it stalled in committee. Wisconsin’s age-verification bill originally contained VPN language that was stripped in February 2026 before the governor vetoed the bill in April. Aylo’s complaint says no state had enacted a deemed-location clause before, and we found no other enacted US statute that names VPNs. The legislatures watching the case now have their answer: the first deemed-location clause did not survive its first motion. The order even sketches what would: a statute that asks for reasonable geolocation efforts rather than perfect ones. Expect the next round of drafting, in Utah’s 2027 session and elsewhere, to use that word. California, meanwhile, is routing around the problem from the other end: its Digital Age Assurance Act, effective January 2027, has the operating system pass a parent-declared age bracket to apps, an approach that needs no IP geolocation and mentions no VPNs.

What Should Someone in Utah Do About Their VPN?

Nothing, in the sense that no obligation has landed on you and none is proposed. A few practical notes, though, because the second-order effects of laws like this one are felt by ordinary users rather than by the sites they target.

1. Keep the VPN on for what it is for. Encryption on public Wi-Fi, a stable IP for banking and work logins, and a barrier between your browsing and your ISP are all unaffected. If you want a nearby exit, Le VPN runs a server in Salt Lake City alongside its other US locations, so a Utah-based connection can stay in Utah.
2. Expect more sites to challenge VPN traffic, everywhere. The rational response to a liability rule with no reliable detection is over-blocking. If a site that has nothing to do with Utah starts refusing your VPN connection, that is the compliance reflex spreading, not a sign that your VPN is doing anything wrong. Switching server is usually enough.
3. Do not take the law as a puzzle to solve. SB 73 bans covered sites from teaching visitors how to route around age checks, and this article is not going to do it for them. Age verification for adult content is constitutional and here to stay; the open question in Utah is only who bears the burden when the tools cannot tell where a person is.
4. Watch the appeal window and the 2027 session, not October 22. The dates this article once told you to watch are spent: the ruling arrived on September 24 and mooted the October 22 truce deadline. What remains live is whether Utah appeals to the Tenth Circuit before its roughly 30-day window closes around October 26, whether the Division finalizes rule R152-78B now that its location half implements a blocked clause, and whether the legislature rewrites the statute with a reasonableness standard when it convenes in late January.

If you want the broader map of where VPNs are restricted and where they are simply regulated, our country-by-country guide to VPN legality in 2026 covers it, and our United States page lists the US server locations. For a European parallel, France’s regulator went through a very similar fight over adult-site age checks last year; we covered how that played out, including the same over-blocking dynamic that Utah is now importing.

The short version to pass along to anyone who sends you the headline: Utah’s VPN clause regulated websites rather than people, a federal judge has now blocked it because it demanded a perfection no technology can deliver, the rest of the law stands, and the next moves belong to Utah, in an appeals court or in next year’s legislature.