A federal court in Utah has issued a preliminary injunction, temporarily preventing the state from enforcing a provision of its age verification law that would hold adult websites liable if minors use virtual private networks (VPNs) or other tools to bypass age verification efforts.

The injunction, issued by District Judge David Barlow on Thursday, September 24, 2026, means that the "deemed-location" provision of Utah's SB 73 cannot be enforced pending further action by the court. This provision states that an individual is considered to be accessing a website from Utah if they are physically in the state, regardless of whether they use a VPN, proxy server, or other means to disguise their geographic location.

Legal Challenge and Arguments

Pornhub parent company Aylo filed a complaint with the U.S. District Court for the District of Utah, Central Division, in April, seeking an injunction against the "deemed-location" provision of SB 73. SB 73, formally known as the Online Age Verification Amendments, was signed into law in March and regulates commercial websites where more than one-third of the material is considered harmful to minors.

In its complaint, Aylo contended that the deemed-location/VPN provisions of the law threaten adult entertainment companies with civil penalties and potential criminal liability. Aylo argued that the law would require them to implement Utah’s age-verification regime "for every user of their platforms, anywhere in the world." The company asserted that this would constitute "impermissible extraterritorial legislation" because Utah would be "projecting its policy choices onto conduct occurring entirely outside its borders, in states and countries that have made different legislative judgments."

The complaint also argued that the law violates the dormant Commerce Clause by "imposing significant burdens on, and purporting to regulate, the national and international markets for adult entertainment." Additionally, Aylo's lawsuit made allegations of "unlawful state extraterritorial regulation" and violations of the Foreign Commerce Clause by interfering with international transactions involving foreign entities and nationals. Aylo Freesites Ltd. and Aylo Group Ltd. are foreign corporate entities owned by Aylo's network of shell companies, headquartered in Montreal, Québec, and held by Ethical Capital Partners, based in Ottawa, Ontario.

Attorneys representing Aylo include Annika L. Jones and Brandon S. Fuller from the Salt Lake City office of Snell & Wilmer LLP, and Lindsay Harrison from the Washington, D.C. office of Jenner & Block LLP.

Enforcement Delays and Stipulations

The "deemed-location" rule was initially set to come into force in May. However, its enforcement was temporarily put on hold after Aylo and the Utah Division of Consumer Protection agreed to a period of forbearance. During this period, enforcement of the VPN rule was suspended. This initial agreement, secured in late April, delayed enforcement until September 3, according to court documents. The delay agreement applied only to Aylo sites.

The period of forbearance was subsequently extended. On August 28, the parties agreed to extend the pause until October 22, 2026, or until the federal court ruled on Aylo’s preliminary-injunction request, whichever occurred first. This extension followed the Utah Division of Consumer Protection issuing a proposed rule implementing SB 73, which included criteria for what constitutes an acceptable standard for addressing "geolocation obfuscation." This proposed rule was planned to take effect on October 8.

In a recent court filing, the Utah Department of Commerce and Aylo entered into a joint stipulation. The agency agreed not to enforce the new law pending Judge Barlow's ruling or until administrative rules setting the specific terms for adult sites to comply with the law were finalized. In exchange, Aylo agreed to maintain its current "geofencing practices."

Industry attorney Corey Silverstein noted that while the renewed "period of forbearance" technically applied only to sites operated by Aylo, Utah would likely find it impractical to enforce the law against any site or company until the pending motion for preliminary injunction was ruled upon. However, Silverstein emphasized that sites and companies should still consult with their own legal counsel regarding potential enforcement actions.

Court's Decision and Implications

District Judge David Barlow's order on September 24, 2026, stated that "Plaintiffs have demonstrated that Utah Code section 78B-3-1002(3), the actual-location provision, is likely to violate the United States Constitution’s dormant Commerce Clause, that irreparable harm will result, and that the equities favor an injunction."

The court's order specifically states that "Defendants and their agents, employees, and persons in active concert or participation with them shall not enforce Utah Code section 78B-3-1002(3) until further order of this court."

This preliminary injunction does not prevent Utah from enforcing other provisions of its age verification law. The VPN provision in the Utah law reflects broader concerns about the use of techniques to circumvent age verification, which has led to both state and federal efforts to address this issue.

Key Facts

  • A federal court issued a preliminary injunction against Utah's "deemed-location" provision of SB 73 on September 24, 2026.
  • The injunction prevents enforcement of the provision that would make adult websites liable if minors use VPNs to bypass age verification.
  • Pornhub parent company Aylo filed the complaint in April, arguing the law is extraterritorial and violates the dormant Commerce Clause.
  • Enforcement of the VPN rule was previously delayed through agreements between Aylo and Utah officials, with the latest pause set to expire on October 22, 2026, or upon a court ruling.
  • District Judge David Barlow found that the provision is likely to violate the dormant Commerce Clause and that irreparable harm would result without an injunction.
  • The injunction does not affect other provisions of Utah's age verification law.