Utah pauses VPN age-check law enforcement as Aylo lawsuit continues

Utah has become the first U.S. state to enact a law that specifically targets VPN use to bypass age-verification checks on adult websites. The state has now agreed to pause enforcement while a federal lawsuit brought by Aylo, the parent company of Pornhub, continues.

Utah’s Department of Commerce said it would not enforce the measure, formally known as the Online Age Verification Amendments (SB 73), against adult websites after it took effect on September 3. The law was originally scheduled to take effect in May, but enforcement was delayed after Aylo challenged it in federal court.

Aylo argues that the mandate creates an unworkable technical standard for online platforms. A person using a VPN can connect through a server in another country, making it difficult for a website to determine whether that user is physically in Utah. The law also bars covered websites from sharing instructions for using a VPN to bypass age checks.

The Electronic Frontier Foundation has warned that the legal risks could push websites to require age verification from every visitor globally, subjecting millions of users to identity checks or restrictions on VPN use. A judge has not committed to a date for a ruling, leaving enforcement on hold as the case continues.