Aylo, the parent company of Pornhub.com, has secured an agreement with the state of Utah to delay enforcement of a new law prohibiting the use of virtual private networks (VPNs) to bypass age verification statutes. This agreement, which currently applies only to Aylo sites, pushes the enforcement date to September 3, 2026.

Legal Challenge and Constitutional Claims

Aylo filed a lawsuit in late April in the U.S. District Court for the District of Utah, naming the Utah Division of Consumer Protection and the state's Department of Commerce as defendants. The lawsuit alleges multiple constitutional violations, including claims that the state is infringing upon the interstate commerce and foreign commerce clauses of the U.S. Constitution.

The legal action also includes allegations of "unlawful state extraterritorial regulation." Aylo Freesites Ltd. and Aylo Group Ltd., identified as foreign corporate entities, are part of Aylo's network of shell companies headquartered in Montreal, Québec. These entities are further held by Ethical Capital Partners, an ownership group based in Ottawa, Ontario.

Attorneys representing the plaintiffs contend that the new law is unconstitutional for three distinct reasons. They argue it constitutes impermissible extraterritorial legislation, violates the dormant Commerce Clause, and infringes upon the Foreign Commerce Clause by interfering with international transactions involving foreign entities and foreign nationals.

The legal team representing Aylo includes Annika L. Jones and Brandon S. Fuller, a partner and associate, respectively, from the Salt Lake City office of Snell & Wilmer LLP. Additionally, a team from the Washington, D.C. office of Jenner & Block LLP is involved, including D.C. managing partner Lindsay Harrison.

Utah's VPN Law: Senate Bill 73

The law at the center of this legal dispute is formally known as the “Online Age Verification Amendments,” or Senate Bill 73 (SB 73), which Governor Spencer Cox signed on March 19, 2026. While a significant portion of the bill addresses a 2% tax on revenues from online adult content, set to take effect in October, the section regulating VPN access was an immediate concern for organizations like the EFF.

The VPN provisions of SB 73 went into effect on May 6, 2026. Section 14 of the new law specifically amends Section 78B-3-1002 of existing Utah statutes, primarily by regulating VPN use based on physical location. According to the EFF, Utah is the first state to target the use of VPNs to circumvent legally mandated age-verification gates.

The EFF noted that while similar provisions in states like Wisconsin were removed due to constitutional and technical concerns, Utah proceeded with its mandate. The organization highlighted a trend of increased VPN usage in states and countries that implement age-verification mandates, citing examples such as Florida, Missouri, Texas, the United Kingdom, Australia, and Indonesia.

Enforcement Delay and Future Implications

The agreement reached between Aylo and the state of Utah prevents the enforcement of the VPN law until September 3, 2026. This delay, secured through court documents, provides a 120-day reprieve for Aylo sites. The initial effective date for the VPN provisions was May 6, 2026.

The lawsuit's allegations of constitutional violations, particularly concerning interstate and foreign commerce, suggest a broader legal challenge to the state's authority in regulating online content and access. The involvement of foreign corporate entities and an ownership group based in Canada further complicates the legal landscape, bringing into focus issues of extraterritorial regulation.

Key Facts

  • Aylo, parent company of Pornhub.com, sued the state of Utah in late April 2026.
  • The lawsuit challenges Utah's new law prohibiting VPN use to circumvent age verification.
  • An agreement was reached to delay enforcement of the VPN law until September 3, 2026, for Aylo sites.
  • Aylo alleges constitutional violations, including breaches of the interstate commerce and foreign commerce clauses.
  • The lawsuit also claims "unlawful state extraterritorial regulation."
  • Utah's VPN law, Senate Bill 73, went into effect on May 6, 2026.