A federal judge in Utah has issued a preliminary injunction, temporarily blocking the enforcement of a state law that prohibited the use of virtual private networks (VPNs) to circumvent age verification on adult websites. The ruling, issued on September 24, 2026, by U.S. District Judge David Barlow, stems from a lawsuit filed by Aylo, the parent company of Pornhub.com.

Injunction Granted Against VPN Provision

Judge Barlow’s injunction prevents Utah from enforcing the "deemed-location" provision of Senate Bill (SB) 73. This provision stipulated that an individual was considered to be accessing a website from Utah if they were physically in the state, regardless of their use of VPNs, proxy servers, or other tools designed to mask geographic location. The injunction means that this specific part of SB 73 cannot be enforced while the litigation proceeds.

Aylo, through two of its affiliated companies, filed a complaint with the U.S. District Court for the District of Utah, Central Division, in April. The lawsuit targeted Utah's Division of Consumer Protection and its Department of Commerce. Initially, a mutually agreed-upon delay in enforcing the statute for 120 days was established. This delay was later extended into October under a mutual agreement submitted to the court at the end of August.

SB 73, formally known as the Online Age Verification Amendments, was signed into law in March. It regulates commercial websites where more than one-third of the material is considered harmful to minors. The law expands on Utah's 2023 age-verification law (SB 287), which requires proof of age, such as a digital ID card, a third-party verification service, or a credit card, to view adult content. Pornhub had previously blocked itself from Utah when SB 287 went into effect.

The "deemed-location" provision of SB 73 aimed to prevent adult websites from facilitating or encouraging the use of VPNs. The Electronic Frontier Foundation, a digital civil liberties nonprofit, described this requirement as "a technical whack-a-mole that likely no company can win."

Constitutional Concerns and Irreparable Harm

U.S. District Judge David Barlow, an appointee of President Donald Trump, found that the potential harm of a constitutional violation outweighed Utah's interest in enforcing a statutory provision that he deemed "likely unconstitutional."

Aylo argued in its complaint that the deemed-location/VPN provisions of SB 73 threatened adult entertainment companies with civil penalties and potential criminal liability. The company contended that the law would effectively require them to implement Utah’s age-verification regime "for every user of their platforms, anywhere in the world," which it asserted would constitute "impermissible direct regulation of wholly out-of-state conduct."

Judge Barlow concluded that "Aylo has shown a substantial likelihood of a constitutional violation and irreparable harm from that violation." He further explained that "it follows that the balance of equities and the public interest are in its favor." The district judge also found that requiring the lifting of "masking" technology to reveal a user's "actual location" likely violates the dormant Commerce Clause, indicating that Utah's restriction on interstate commerce infringes upon the U.S. Constitution.

The court noted that "because it is impossible to always determine where a user is actually located, Utah’s actual-location provision will require it to age-verify all users, wherever they might actually be located, or face liability." This interpretation suggests that Utah can only enforce elements of web traffic that can be proven to originate from Utah. Given that VPN software is inherently extraterritorial, a state-level provision blocking VPN usage faces constitutional challenges.

Industry Reaction and Future Implications

Corey Silverstein, an attorney representing adult industry clients, viewed the ruling as a positive development. Silverstein stated that the VPN provision placed an "impossible burden on adult websites by effectively requiring them to determine the true physical location of users who may be utilizing technology specifically designed to conceal that information." He observed that the practical consequence was potentially forcing websites to apply Utah’s requirements to users across the country and around the world.

Silverstein commended Aylo for committing resources to challenge the provision and for continuing to fight laws that raise constitutional and practical concerns for the adult industry.

A spokesperson for Aylo expressed satisfaction with the court’s ruling and its consideration of the issues. The spokesperson affirmed Aylo's commitment to complying with applicable law while safeguarding user privacy and security. The spokesperson also clarified that while Aylo believes Utah’s age-verification law is not sufficiently protective of users’ privacy, that specific law is not at issue in this case. Aylo stated that age verification is beneficial if implemented correctly and can contribute to a safer internet. The company also noted that age verification legislation in other jurisdictions is failing due to inconsistent and ineffective enforcement, leaving many platforms with age-inappropriate content accessible.

Key Facts

  • On September 24, 2026, U.S. District Judge David Barlow granted a preliminary injunction to Aylo, blocking enforcement of the VPN prohibition in Utah's SB 73.
  • SB 73 is a Utah law that aimed to prevent the use of VPNs to bypass age verification on adult websites.
  • Aylo, parent company of Pornhub.com, filed a lawsuit in April against Utah's Division of Consumer Protection and Department of Commerce.
  • Judge Barlow found that the VPN provision of SB 73 likely violates the U.S. Constitution, specifically the dormant Commerce Clause.
  • The injunction temporarily blocks the "deemed-location" provision of SB 73, which considered users physically in Utah to be accessing from Utah regardless of VPN use.
  • An Aylo spokesperson stated the company is pleased with the ruling and remains committed to user privacy and security.