A federal judge in Utah has struck down the part of the state's new age-verification statute that would have forced websites to unmask visitors even when those visitors use a VPN to shield their location. The ruling, issued days before related state rules were set to take effect, is a rare legal check on the growing push to treat privacy tools as obstacles to be defeated rather than protected. For the millions of people who rely on encrypted tunneling to keep their browsing confidential, the decision offers at least temporary relief, though the underlying law remains largely intact.
Utah already required adult websites to verify the age of visitors connecting from inside the state. In March, lawmakers expanded that mandate through SB 73, adding language declaring that a person counts as being in Utah "regardless of whether the individual is using a virtual private network, proxy server, or other means" to obscure their whereabouts. A VPN works by routing a device's internet traffic through a remote server, so the website on the other end sees the server's location instead of the user's own. For someone who simply wants reliable, unthrottled connections while streaming or working remotely, choosing a VPN with consistent streaming access has nothing to do with evading child-safety rules and everything to do with basic digital hygiene. SB 73 also barred adult sites from publishing instructions on bypassing age checks through such tools, making Utah, according to the Electronic Frontier Foundation, the first state known to specifically target VPN use in this context. a VPN with consistent streaming access
Why "Finding" a VPN User Is Technically Unworkable
The core problem is that masking location is the entire point of a VPN. A website cannot distinguish a Utah resident connecting through a server in Seattle from a traveler in Shanghai using the same server. To comply with Utah's language, a site would effectively need to block all VPN traffic everywhere, verify the age of every visitor on Earth, or withdraw from the state altogether. With fines reaching $2,500 per violation, the stakes were high enough to reshape how platforms treat privacy software far beyond Utah's borders.
District Judge David Barlow granted a preliminary injunction on September 24 in a lawsuit brought by Aylo, the company that operates Pornhub. He concluded that the law demanded "geolocation with perfection," a standard the state itself conceded is not achievable with current technology. Enforcing it literally, he wrote, would require verifying the age of roughly 28 million users regardless of where they claimed to be located. Utah argued it only intended to require reasonable effort, but the judge found no such limitation written into the statute itself.
A Narrow Ruling With Wider Stakes
The injunction rests on constitutional limits around states regulating conduct beyond their borders, not on free-speech grounds. Utah's general age-verification requirement still stands, as does the ban on sites offering VPN workaround advice. Separately, the state's Division of Consumer Protection had proposed rules requiring "commercially reasonable geolocation obfuscation detection systems" accurate at least 95 percent of the time, relying on signals like connection latency or device time zones. The EFF argued these methods are unreliable and would misidentify ordinary users while deepening surveillance of exactly the people trying to avoid it. Those rules cannot be enforced while litigation continues, but Utah may appeal, and other states are reportedly considering similar measures, meaning the broader fight over whether privacy tools can be treated as red flags is only beginning.