A federal court has paused Aylo’s lawsuit challenging a Utah law that would hold adult websites liable if minors bypass age verification by circumventing geolocation efforts, pending potential amendments to the statute by the state legislature. Both parties in the case requested a stay of proceedings, anticipating legislative changes to the "deemed-location" provision of Utah’s SB 73.

Legal Challenge and Preliminary Injunction

The case originated in April when Aylo, the parent company of Pornhub, filed a complaint with the U.S. District Court for the District of Utah, Central Division. Aylo sought an injunction against the "deemed-location" provision of Utah’s SB 73, an age verification bill signed into law in March. This provision states that an individual is considered to be accessing a website from Utah if they are physically in the state, regardless of whether they use a virtual private network (VPN), proxy server, or other means to disguise their geographic location.

In its complaint, Aylo argued that the deemed-location/VPN provisions of the law would expose adult entertainment companies to civil penalties and potential criminal liability. The company contended that the law would necessitate implementing Utah’s age-verification regime "for every user of their platforms, anywhere in the world." Aylo asserted that this requirement would constitute "impermissible extraterritorial legislation," as Utah would be "projecting its policy choices onto conduct occurring entirely outside its borders, in states and countries that have made different legislative judgments."

On September 24, 2026, District Judge David Barlow issued a preliminary injunction, temporarily preventing the state from enforcing the VPN provision of SB 73. The state had previously agreed not to enforce the rule pending the judge’s ruling. In his order, Judge Barlow agreed with Aylo that it would be nearly impossible for the company to comply with the age-verification law, as it would require "geolocating its website users with perfection to avoid liability." The judge noted that it is "undisputed" that technology capable of perfect geolocation does not yet exist. He ruled that Aylo is likely to succeed in its case, having demonstrated that the law causes irreparable harm to the company. The court also ruled that the law likely violates the U.S. Constitution’s prohibition on passing laws that significantly burden businesses and people outside Utah’s borders.

The Electronic Frontier Foundation (EFF) submitted comments to the Utah Department of Commerce, detailing how forcing platforms to detect and block privacy-preserving tools undermines user privacy and security worldwide while demanding the impossible. SB 73, formally known as the Online Age Verification Amendments, regulates commercial websites where more than one-third of the material is considered harmful to minors. The law also prohibited websites from offering instructions on how to use a VPN to bypass these checks, making Utah the first state, to EFF’s knowledge, to target the use of VPNs to avoid legally mandated age-verification gates.

Stay of Proceedings and Legislative Anticipation

On October 13, 2026, a federal court granted a joint motion from Aylo and the state of Utah to stay further proceedings in the case. Both parties anticipate that the Utah legislature may amend the challenged statute during its next general session. The legislative session is scheduled to begin on January 19, 2027, and conclude on March 5, 2027. Judge David Barlow granted the motion, pausing the case until the end of this session.

The joint filing stated, "Rather than continuing to litigate Plaintiffs’ claims against the current version of S.B. 73, the parties therefore agree that staying further proceedings in this case would be the most efficient course for both the parties and the Court to see what, if any, amendments the Legislature makes to the provision of S.B. 73 challenged in this case."

Broader Implications and Related Cases

The VPN provision in the Utah law reflects growing concern about the widespread use of techniques to circumvent age verification. This concern has inspired both state and federal efforts to address this practical loophole. The main purpose of a virtual private network is to secure and encrypt an individual’s traffic on the web, as well as change the user’s location.

Aylo is also currently a defendant in a lawsuit brought by the state of Indiana. Indiana contends that Aylo violated that state’s age verification law by failing to prevent access by users who employ VPNs and similar means to avoid geolocation. Earlier in October, Aylo filed a brief with the Marion Superior Court, citing the district court’s preliminary injunction in the Utah case as evidence that Indiana’s case against the company should be dismissed.

In a separate development, a German high court temporarily barred a state media regulator from ordering internet providers to cut off access to Aylo-owned adult sites Pornhub and YouPorn in Germany on October 9, 2026. This temporary block is pending further action by Cypriot and European Union authorities.

Key Facts

  • A federal court has paused Aylo’s lawsuit against Utah’s SB 73 "deemed-location" provision.
  • The pause is in effect until the Utah legislature’s next general session, from January 19, 2027, to March 5, 2027.
  • Aylo filed the complaint in April, challenging the law’s requirement for adult websites to verify the age of users physically in Utah, even if they use VPNs.
  • On September 24, 2026, Judge David Barlow issued a preliminary injunction, blocking enforcement of the VPN provision.
  • The court found that perfect geolocation technology does not exist and that the law likely imposes an impossible burden on companies.
  • Aylo is also involved in a lawsuit with the state of Indiana regarding VPN use and age verification.