Utah's Senate Bill 73, formally titled the "Online Age Verification Amendments," became effective on May 6, 2026, significantly expanding the state’s regulatory framework for adult websites. This legislation introduces aggressive anti-circumvention provisions, holding adult websites liable even when Utah users employ VPNs or other geo-masking technologies to bypass age-verification systems.

Utah's Expanded Age Verification Requirements

Utah has positioned itself at the center of the national debate over online age verification and adult-content regulation with the enactment of SB 73. The law goes beyond traditional age-verification requirements by attempting to hold adult websites liable even when Utah users utilize VPNs or other geo-masking technologies to bypass age-verification systems. Under the statute, a user physically located in Utah is deemed to be accessing a website "from Utah" regardless of whether they conceal their location through a VPN, proxy service, or similar technology.

The legislation also imposes a 2% excise tax on companies subject to Utah’s age-verification rules. This tax is scheduled to begin in October 2026. Administrative enforcement is authorized through the Utah Division of Consumer Protection, and the law creates civil penalties and damages exposure for alleged violations. Furthermore, SB 73 prohibits platforms from assisting or encouraging users to circumvent verification requirements by using VPNs.

Lawmakers characterize the measure as a child-protection initiative. Critics, however, argue that the statute effectively imposes strict liability on platforms that attempt to comply in good faith with technologically imperfect systems. On May 6, 2026, Utah became the first U.S. state to hold website operators directly responsible when users use a VPN or proxy to bypass age verification. The law does not target VPN providers but targets the operator, and it does not accept "they used a VPN" as a defense.

The response from the privacy and security community has been immediate. NordVPN called the law "an unresolvable compliance paradox." TechRadar, reporting on digital rights experts' reactions, described it as "a technical whack-a-mole that likely no company can win." Both descriptions refer to the problem that traditional VPN detection may not work well enough to satisfy a per-violation liability standard. Civil liberties groups are calling it a dangerous precedent, and the VPN industry states it is technically unenforceable.

Legal Challenges and Industry Concerns

Aylo, the parent company of Pornhub and other major adult platforms, has initiated a constitutional challenge against SB 73. Aylo’s lawsuit specifically targets the constitutionality and enforceability of the VPN-related provisions of SB 73. The company argues that Utah is attempting to impose liability for conduct beyond a platform’s reasonable technical control while simultaneously burdening lawful adult access to constitutionally protected speech. Enforcement of certain provisions of the law has been temporarily paused while the case proceeds in federal court.

This lawsuit follows the U.S. Supreme Court’s decision to uphold Texas’s age-verification law in Free Speech Coalition v. Paxton. However, Utah’s SB 73 is seen as going further than the Texas law by attempting to regulate technological circumvention itself and placing the burden of defeating VPN usage on publishers and platforms. Courts generally supportive of age-verification laws may hesitate when statutes impose liability for conduct that platforms cannot realistically prevent. The constitutional analysis shifts from simple age gating to questions involving overbreadth, vagueness, due process, and compelled-surveillance obligations. Aylo’s challenge may also raise dormant Commerce Clause concerns, as critics argue that conflicting state-by-state compliance mandates risk fragmenting internet regulation nationwide.

For the adult industry, the concern extends beyond Utah. SB 73 represents a growing trend toward expansive internet regulation targeting adult-content providers. What began as age-verification legislation is evolving into broader digital identity and platform-liability regulation. Critics warn these laws create privacy risks for consumers while potentially pushing users toward unregulated offshore platforms that may have weaker moderation, fewer compliance safeguards, and less accountability. Some major adult platforms have already chosen to block access entirely in certain jurisdictions.

Privacy Implications and Enforcement Challenges

Another significant issue surrounding SB 73 involves user privacy. While supporters frame these laws as child-protection measures, civil liberties advocates, digital rights organizations, and cybersecurity professionals have warned that mandatory identification systems pose substantial privacy and security risks for lawful adult users. Consumers may be required to upload government-issued identification, facial scans, or other sensitive personal data to access constitutionally protected content, raising concerns about data retention, breaches, and secondary uses.

The adult industry has historically been a target for hacking, extortion, and reputational attacks. Critics of aggressive verification laws argue that forcing users to connect their identities to adult browsing habits creates the type of centralized sensitive-data ecosystem that bad actors seek to exploit. The law redefines how location is determined, stating that an individual is considered to be accessing a website from Utah if they are physically located in the state, regardless of IP address or VPN use. This regulation places the burden of compliance on the website operator, regardless of the user's actual location or the use of tools to disguise their geographic origin.

The outcome of Aylo’s lawsuit may determine whether states can lawfully force platforms to police VPN usage and impose liability for technological circumvention by users. If Utah prevails, other states may rapidly adopt similar provisions. If Aylo succeeds, courts may establish constitutional limits on how far states can go in outsourcing enforcement burdens to online publishers. This litigation represents a major chapter in the ongoing collision between online privacy, free speech, and state-level internet regulation, with the outcome potentially defining the next generation of compliance obligations nationwide for the adult industry.

Key Facts

  • Utah's SB 73, the "Online Age Verification Amendments," became effective on May 6, 2026.
  • The law holds adult websites liable for users physically located in Utah, even if they use VPNs to bypass age verification.
  • SB 73 imposes a 2% excise tax on companies subject to Utah’s age-verification rules, starting in October 2026.
  • The legislation authorizes administrative enforcement by the Utah Division of Consumer Protection and creates civil penalties for violations.
  • Aylo, parent company of Pornhub, has filed a lawsuit challenging the constitutionality of the VPN-related provisions, leading to a temporary pause in enforcement of certain sections.
  • Critics argue the law creates an "unresolvable compliance paradox" and poses significant privacy and security risks for users.