Enforcement of Utah’s law targeting the use of virtual private networks (VPNs) to bypass age verification on adult content sites has been further delayed until October 22, following an agreement between the state and Pornhub parent company Aylo. This marks an extension of a previous pause that was set to expire on September 3.

The agreement was communicated to a federal district court on Thursday, August 31, 2026. The state’s consumer protection authorities are currently soliciting public comments regarding the enforcement of these new regulations.

Background of Utah’s VPN Law

Utah’s “Online Age Verification Amendments,” formally known as Senate Bill 73 (SB 73), was signed into law by Governor Spencer Cox on March 19, 2026. While the bill includes provisions for a 2% tax on revenues from online adult content, set to take effect in October, a more immediate concern for digital privacy advocates was the section regulating VPN access.

The VPN provisions of SB 73 went into effect on May 6, 2026, making Utah the first state to target the use of VPNs to circumvent legally mandated age-verification gates. Section 14 of the law amends Section 78B-3-1002 of existing Utah statutes, primarily by regulating access based on physical location. The law states that an individual is considered to be accessing a website from Utah if they are physically located in the state, regardless of whether they are using a VPN, proxy server, or other means to disguise their geographic location.

SB 73 expands upon Utah's 2023 age-verification law (SB 287), which mandates proof of age, such as a digital ID card, a third-party verification service, or a credit card, to view adult content or content deemed "harmful to minors" by the state. When SB 287 initially went into effect, Pornhub blocked its content from users in Utah.

The new law also instructs that a porn site cannot "facilitate or encourage the use of a virtual private network [VPN]." This functionally requires adult content sites to block traffic from VPNs, a technical challenge that the Electronic Frontier Foundation (EFF) has described as "a technical whack-a-mole that likely no company can win."

Legal Challenges and Enforcement Pauses

The initial enforcement of Utah’s VPN law was put on hold after Aylo, the parent company of Pornhub.com, filed a lawsuit in the U.S. District Court for the District of Utah, Central Division. Aylo filed a complaint on April 22, 2026, against the Utah Division of Consumer Protection and the state's Department of Commerce, seeking an injunction against the VPN provisions of the law. Aylo stated that there is "no feasible way for a private company like Aylo to reliably verify whether any particular individual is using a virtual private network."

Following Aylo's legal challenge, Utah agreed on May 11, 2026, not to enforce the VPN law until September 3, 2026. This period of forbearance technically applied only to sites operated by Aylo. However, industry attorney Corey Silverstein advised XBIZ that, from a practical standpoint, Utah would find it difficult to enforce the law against any site or company until a pending motion for preliminary injunction is ruled upon. Silverstein also emphasized that sites and companies should still consult with their own legal counsel as they may remain subject to enforcement actions.

The latest agreement between Aylo and the state of Utah further extends this pause in enforcement until October 22, 2026. This delay allows for continued legal proceedings and public input on the implementation of the new rules.

Broader Context of Age Verification and VPNs

The situation in Utah reflects a broader trend observed globally. States and countries that implement age-verification mandates often see a surge in VPN usage as residents seek to maintain their privacy and anonymity online. This pattern has been noted in various locations, including Florida, Missouri, Texas, the United Kingdom, Australia, and Indonesia.

The EFF has highlighted that Utah lawmakers, instead of addressing concerns about mass surveillance and age gates, have focused on VPNs as the primary issue. While similar provisions in states like Wisconsin were removed due to constitutional and technical concerns, Utah has proceeded with a mandate that the EFF believes threatens to significantly undermine digital privacy rights.

The 2% excise tax on adult sites operating in Utah, also part of SB 73, is still scheduled to take effect on October 1, 2026, separate from the ongoing delays concerning the VPN provisions.

Key Facts

  • Enforcement of Utah’s VPN law for adult content sites is paused until October 22, 2026.
  • The delay is a result of an agreement between the state of Utah and Aylo, parent company of Pornhub.
  • Aylo filed a lawsuit on April 22, 2026, challenging the VPN provisions of Senate Bill 73 (SB 73).
  • SB 73, signed on March 19, 2026, aims to prevent the use of VPNs to bypass age verification on adult websites.
  • The law’s VPN provisions initially took effect on May 6, 2026, but enforcement was first paused until September 3, 2026.
  • Utah consumer protection authorities are currently seeking public comments on enforcing the new rules.