Judge Blocks Utah's VPN Age-Verification Clause, Not the Law

Federal Judge Blocks Utah's VPN Clause in Its Age-Verification Law

A federal judge in Utah preliminarily blocked one subsection of the state's age-verification statute on September 24, 2026: the clause that applied the law to users physically in Utah even when a VPN hides where they are. The duty to age-verify Utah users itself survives.

Information last verified on October 1, 2026.

Status: Preliminary injunction entered September 24, 2026 in Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340-DBB-JCB (D. Utah), ECF No. 67. It reaches only Utah Code 78B-3-1002(3). There is no final judgment, no ruling on the age-verification duty in subsection (1)(a), and no appellate decision.

Jurisdiction scope: This article covers one federal district court order about one subsection of Utah's statute on publishers and distributors of material harmful to minors, Utah Code Title 78B, Chapter 3, Part 10. It does not cover Utah's separate social media or app-store age-assurance laws, and it does not describe any other state's regime. For the wider picture, see our survey of state age-verification requirements.

What Happened

On September 24, 2026, District Judge David Barlow of the United States District Court for the District of Utah granted a preliminary injunction against Utah Code 78B-3-1002(3). The 40-page Memorandum Decision and Order is ECF No. 67 in Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340-DBB-JCB, and is published in the govinfo United States Courts Opinions collection.

The plaintiffs are Aylo Freesites Ltd and its parent, Aylo Group Ltd, which operate Pornhub, YouPorn and Redtube. They filed the complaint and the injunction motion on the same day, April 22, 2026 (ECF Nos. 1 and 3). Utah opposed on June 8, 2026 (ECF No. 43), the plaintiffs replied on July 10, 2026 (ECF No. 55), and the court ruled after full briefing and oral argument.

The order sets out all four preliminary-injunction factors and resolves each in the plaintiffs' favor. Its own summary, at page 2 of 40, reads: "the court finds that Plaintiffs are likely to succeed on the merits, they have shown irreparable harm, and the equities favor an injunction."

The decisive step was statutory interpretation. The court held that because "reasonable" appears only in the age-verification provisions and nowhere in the location provision, the location provision carries no reasonableness qualifier.

"In short, Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites' users."

Memorandum Decision and Order, ECF No. 67, at 17 (D. Utah Sept. 24, 2026).

The Utah Attorney General had represented that the state would enforce the clause only under a reasonableness standard, and the court said it credited that statement. It still refused to read the standard into the text, because a court "may impose a limiting construction on a statute only if it is readily susceptible to such a construction," and reading in a reasonableness qualifier here would require "rewriting, not just reinterpretation" (ECF No. 67, at 14, quoting United States v. Stevens, 559 U.S. 460, 481 (2010)).

Two parts of the ruling cut against the plaintiffs and are easy to miss. First, the court rejected Aylo's extraterritoriality theory outright, holding that BMW of North America v. Gore, State Farm v. Campbell and New York Life Insurance Co. v. Head do not reach a law that "only imposes liability when the user is actually located in Utah" (ECF No. 67, at 21, 23). Second, the court refused to extend the injunction to the age-verification duty itself. Aylo's complaint disclaimed any challenge to subsection (1)(a) and then asked for relief covering it anyway; the order answers that in four words at page 39: "This relief cannot be granted."

What did carry the day was the dormant Interstate Commerce Clause, on two tracks. On direct regulation, the court applied Tenth Circuit precedent from ACLU v. Johnson, 194 F.3d 1149 (10th Cir. 1999), and found that a perfection requirement would push an operator to verify every visitor everywhere, so the clause "likely creates too much direct regulation of wholly out-of-state conduct to be lawful" (ECF No. 67, at 31). On Pike balancing, it found the burden heavy and, pointedly, found that Utah's own litigating position proved a less burdensome alternative existed: Utah had argued that a law requiring feasible and reasonable geolocation methods would serve the same interests (ECF No. 67, at 34 to 35). Having found a likely dormant Commerce Clause violation, the court did not reach the Foreign Commerce Clause claim.

What the Law Actually Says

Utah's duty sits in Utah Code 78B-3-1002(1)(a), enacted in 2023: a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors from a website containing a substantial portion of such material "shall perform reasonable age verification methods to verify the age of an individual attempting to access the material." A "substantial portion" is more than 33-1/3% of a website's total material that meets the harmful-to-minors definition, and "reasonable age verification methods" is a defined term listing four permitted approaches, including a digitized identification card, a third-party verification service, a commercially reasonable transactional-data method, and any process established by the Division by rule (Utah Code 78B-3-1001(11) and (12)). Our page on how Utah's age-verification law works walks through the duty and who it covers.

Section 14 of S.B. 73 added the enjoined text, which now appears as subsection (3) in its entirety:

"An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location to make it appear that the individual is accessing a website from a location outside this state."

Utah Code 78B-3-1002(3) (effective May 6, 2026), as amended by Laws of Utah 2026, ch. 220.

S.B. 73, titled Online Age Verification Amendments, did considerably more than that. It also added subsection (4), barring a covered entity from facilitating or encouraging VPN or proxy use to circumvent age verification, including by posting instructions; gave the Division of Consumer Protection investigative and enforcement powers with administrative fines and civil penalties of up to $2,500 per violation and up to $5,000 for violating an order (Utah Code 78B-3-1004); granted rulemaking authority (78B-3-1005); created a safe harbor for entities meeting Division standards (78B-3-1006); and enacted a severability clause (78B-3-1008). None of that is enjoined. The order is addressed to subsection (3) and nothing else.

One more piece of standing law matters for scope. In Free Speech Coalition, Inc. v. Paxton, No. 23-1122 (June 27, 2025), the Supreme Court held that Texas's age-verification statute "triggers, and survives, review under intermediate scrutiny because it only incidentally burdens the protected speech of adults." Judge Barlow cited that decision once, for the proposition that a state's interest in shielding children from sexual content is important, "even 'compelling.'" Aylo did not bring a First Amendment claim here, and the order decides none.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The order is narrower than its headline and more specific than a general ruling about VPNs. Read the two documents side by side and the mechanism is visible: the Legislature wrote "reasonable" into the age-verification sentence and left it out of the location sentence, and the court treated that difference as deliberate. Utah's litigating position, that the whole statute asks only for reasonable effort, was the position the court said would have avoided the problem. The order quotes Aylo's own reply on that point: if the amendment had been written the way the Attorney General defended it, "we would not be here" (ECF No. 67, at 40).

That makes the holding unusually drafting-specific rather than technology-specific. Nothing in the order says a state may not reach VPN users, and nothing in it says geolocation is constitutionally out of bounds. The Pike discussion runs the other way, treating Utah's interest in keeping minors away from this material as substantial and squarely within the state's traditional power, and treating the availability of a reasonableness-based alternative as the reason the perfection version fails.

It is also worth separating the two constitutional questions that age-verification litigation now runs on. Free Speech Coalition v. Paxton answered the First Amendment question about verification duties under intermediate scrutiny. This order answers a different question, about a state's power under the dormant Commerce Clause to impose a duty whose practical reach extends to users with no connection to the state. Age-verification cases are increasingly decided on which of those frames applies, which is visible in the app-store verification dispute we covered in the Supreme Court's review of Texas SB 2420 and in the Sixth Circuit's NetChoice ruling on Tennessee.

Finally, the pending rulemaking sits oddly against the order. Utah's Division of Consumer Protection filed proposed Rule R152-78B on August 14, 2026, published September 1, 2026, which would define a commercially reasonable geolocation-obfuscation detection system as one accurate to at least 95%. Defendants brought that proposed rule to the court's attention on August 18, 2026 (ECF No. 61). The court declined to consider it because it arrived after briefing and oral argument (ECF No. 67, at 14 n.73). The reasonableness standard Utah says it wants is therefore moving through a separate administrative track, and this order did not evaluate it.

How This Affects You

For a reader in Utah, the practical landscape is unchanged in one respect and changed in another. Covered adult sites still owe a reasonable age-verification duty to Utah users under subsection (1)(a), and the prohibition in subsection (4) on a covered site facilitating VPN circumvention is also untouched. What is enjoined is the rule that treated a VPN user as a Utah user for purposes of that duty regardless of what the operator could detect.

Because this is a preliminary injunction rather than a judgment, the enjoined text has not been repealed and remains on the books in the Utah Code. A preliminary injunction can be modified, dissolved, or reversed on appeal, and the posture can change without the statutory text changing at all.

What Happens Next

Several threads are open as of October 1, 2026.

The case continues in the District of Utah. The order resolves only the preliminary-injunction motion against subsection (3); the merits, and Aylo's unreached Foreign Commerce Clause claim, are still before the court.

A preliminary injunction is immediately appealable to the Tenth Circuit under 28 U.S.C. 1292(a)(1). We have not confirmed any notice of appeal, and we will not speculate about whether one will be filed or how any appeal would come out.

The rulemaking is the thread most likely to move first. The comment period on proposed Rule R152-78B runs until October 1, 2026, with an anticipated effective date of October 8, 2026 according to the filing in the Utah State Bulletin. The anticipated date in that box is the agency's expectation, not a legal effective date, and we have not confirmed that the rule has been made effective.

The Utah Legislature's 2027 General Session is the other obvious route, since the order identifies the defect as the absence of a reasonableness qualifier in the statutory text. We make no prediction about whether any bill will be introduced.

This article is legal information, not legal advice. It summarizes a single preliminary order and the statutory text it addresses as of October 1, 2026. Court orders change, administrative rules take effect on their own schedules, and nothing here is a substitute for advice from a licensed attorney about your situation.

Related articles

• How Utah's age-verification law works
• State-by-state age-verification requirements
• The Supreme Court takes up Texas's app-store age-verification law
• The Sixth Circuit's NetChoice decision on Tennessee's age-verification rules

Last updated: 2026-10-01. Details verified as of 2026-10-01.

Frequently Asked Questions

Did the court strike down Utah's age-verification law?

No. The September 24, 2026 order (D. Utah) preliminarily enjoined one subsection, Utah Code 78B-3-1002(3). The age-verification duty in subsection (1)(a) was not enjoined, and the court expressly refused to enjoin it (ECF No. 67, at 39).

Is Utah's age-verification requirement still in effect?

Yes. Utah Code 78B-3-1002(1)(a) still requires covered commercial entities to perform reasonable age verification methods, and the chapter's severability clause at Utah Code 78B-3-1008 provides that the remainder stands without an invalid provision.

What exactly did the VPN clause say?

Utah Code 78B-3-1002(3) deemed an individual to be accessing a website from Utah if the individual is 'actually located' in the state, regardless of any virtual private network, proxy server, or other means used to disguise the individual's geographic location.

What was the legal basis for the injunction?

The dormant Interstate Commerce Clause, on both a direct-regulation theory drawn from ACLU v. Johnson, 194 F.3d 1149 (10th Cir. 1999), and Pike balancing. The court rejected the plaintiffs' separate extraterritoriality theory and did not reach their Foreign Commerce Clause claim (ECF No. 67, at 23, 31, 36).

Was this a First Amendment ruling?

No. Aylo brought no First Amendment claim, and the order decides none. The Supreme Court addressed the First Amendment question for Texas's law in Free Speech Coalition, Inc. v. Paxton, No. 23-1122 (June 27, 2025), holding that it survives intermediate scrutiny.

Which bill added the enjoined clause, and when did it take effect?

Section 14 of S.B. 73 (2026 General Session), Laws of Utah 2026 ch. 220. Utah's passed-bills record shows the Governor signed it on March 19, 2026, and the bill's own effective-date section set May 6, 2026 for the Title 78B changes.

Does the ruling make it legal to use a VPN to reach adult sites from Utah?

The order does not address any individual user's conduct. It enjoins the state from enforcing subsection (3) against the plaintiffs' obligations, and Utah Code 78B-3-1002(4), which bars a covered site from facilitating or encouraging circumvention, was not enjoined.

Is the case over?

No. A preliminary injunction rests on a likelihood of success, not a final determination, and the case remains pending in the District of Utah. A preliminary injunction is also immediately appealable to the Tenth Circuit under 28 U.S.C. 1292(a)(1).

What is proposed Rule R152-78B?

A Utah Division of Consumer Protection rule published in the Utah State Bulletin on September 1, 2026 that would set commercially reasonable standards for age verification and for geolocation-obfuscation detection, including at least 95% accuracy in identifying whether a visitor is in Utah. Comments are accepted until October 1, 2026.