Provisions of a Utah law making adult websites liable if minors in the state circumvent geolocation efforts to bypass age verification have again been put on hold temporarily. The enforcement pause, which was set to expire on September 3, has been extended until October 22, 2026, or until the court rules on a pending motion for a preliminary injunction.

The "deemed-location" provision of Utah's SB 73, signed into law in March, was initially set to come into force in May. Pornhub parent company Aylo filed a complaint in April with the U.S. District Court for the District of Utah, Central Division, seeking an injunction against this provision.

Legal Challenge and Forbearance

In its complaint, Aylo contended that the deemed-location/VPN provisions of the law threaten adult entertainment companies with civil penalties and potential criminal liability. The company argues that the law would require them to implement Utah’s age-verification regime "for every user of their platforms, anywhere in the world." Aylo asserts this constitutes "impermissible extraterritorial legislation" because Utah is "projecting its policy choices onto conduct occurring entirely outside its borders, in states and countries that have made different legislative judgments."

The complaint also argued that the law violates the dormant Commerce Clause and Foreign Commerce Clause by "imposing significant burdens on, and purporting to regulate, the national and international markets for adult entertainment." Aylo Freesites Ltd. and Aylo Group Ltd. are foreign corporate entities owned by Aylo's network of shell companies, headquartered in Montreal, Québec, and held by Ethical Capital Partners, based in Ottawa, Ontario.

Attorneys representing Aylo include Annika L. Jones and Brandon S. Fuller from Snell & Wilmer LLP's Salt Lake City office, and Lindsay Harrison from Jenner & Block LLP's Washington, D.C. office.

In May, Aylo and the Utah Division of Consumer Protection agreed to an initial period of forbearance. Under this agreement, the VPN provisions would not be enforced against Aylo until September 3, or longer if the court required more time for a decision. This delay agreement initially applied only to Aylo sites.

According to industry attorney Corey Silverstein, Utah would find it impractical to enforce the law against any site or company until the pending motion for preliminary injunction is ruled upon. However, Silverstein emphasized that sites and companies should still consult with their own legal counsel as they may still be subject to enforcement actions.

Proposed Rule and Continued Delay

Earlier this month, the Utah Division of Consumer Protection issued a proposed rule implementing SB 73. This proposed rule includes criteria for what constitutes an acceptable standard for addressing "geolocation obfuscation" and is planned to take effect on October 8.

As a result of this development, the parties in the case agreed on Thursday, August 28, 2026, to extend the period of forbearance. The new agreement continues the forbearance until October 22, which is two weeks after the effective date of the proposed rule, or until the Court resolves Aylo’s pending motion for a preliminary injunction, whichever comes earlier.

The parties’ joint stipulation states that while Aylo believes the proposed rule is "fundamentally flawed" and does not eliminate their claims or the need for relief, the "Period of Continued Forbearance allows Plaintiffs to participate in that rulemaking process without the threat of liability in the interim." The stipulation also notes that this period "provides the Court with additional time to resolve the current motion for a preliminary injunction, including the discretion to await the outcome of the rulemaking before deciding the motion."

The Utah Division of Consumer Protection is accepting public comments on the proposed rule until October 1.

The "Deemed-Location" Provision

The law’s "deemed-location" provision states: "An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state."

This VPN provision in the Utah law reflects growing concern about the widespread use of techniques to circumvent age verification. This concern has inspired both state and federal efforts to close what is described as a practical loophole.

Key Facts

  • Utah's SB 73, signed in March, includes a "deemed-location" provision making adult websites liable if minors use VPNs to bypass age verification.
  • Pornhub parent company Aylo filed a lawsuit in April seeking an injunction against this provision, citing constitutional violations including extraterritorial legislation and Commerce Clause issues.
  • An initial agreement in May paused enforcement against Aylo until September 3, 2026.
  • The Utah Division of Consumer Protection issued a proposed rule for SB 73, including geolocation obfuscation criteria, planned for October 8, 2026.
  • The enforcement pause has been extended to October 22, 2026, or until the court rules on Aylo's preliminary injunction motion.
  • The Utah Division of Consumer Protection is accepting public comments on the proposed rule until October 1.