Federal judge blocks Utah’s VPN age verification rule

U.S. District Judge David Barlow on September 24 granted a preliminary injunction blocking parts of Utah’s age verification law, SB 73, that target virtual private network (VPN) use. The law requires adult websites to identify and verify the ages of users physically in Utah, including people masking their internet traffic with a VPN. It also bars sites from providing instructions for using a VPN to bypass age checks.

Barlow wrote that the state’s mandates are “likely to violate the United States Constitution,” according to TechRadar. The judge also noted, as reported by KUER, that “perfect geolocation” does not exist. VPNs route traffic through remote servers and hide users’ IP addresses from websites, making a person’s physical location difficult for those sites to establish.

Aylo, the parent company of Pornhub, filed the lawsuit in May. The injunction temporarily pauses enforcement of the VPN location provision; the broader age verification law remains contested, and Utah’s attorney general may appeal.

Utah lawmakers said the measure aimed to address teenagers’ access to restricted content. Gytis Malinauskas, Surfshark’s head of legal, had warned TechRadar that treating VPNs as an illegitimate workaround could erode ordinary users’ privacy. A Proton spokesperson also welcomed the court’s intervention and urged states to draft child safety bills without sacrificing user privacy and security.