Utah Age Verification Law: SB 287, SB 73, and the App Store Act

Utah was the first state to enact an adult-content age-verification law and the first to enact an App Store Accountability Act, and both of its laws survived their court challenges for procedural reasons rather than because a court reached and ruled on the First Amendment merits. That distinction matters: it means Utah's laws are standing today (apart from one 2026 provision enjoined on September 24, 2026), but not for the same reason Texas's law is standing, and this page keeps that difference precise rather than implying an equivalent win.

What Utah's Adult-Content Law Requires

Senate Bill 287 (2023) requires a commercial entity that knowingly distributes material harmful to minors online to use reasonable age-verification or age-assurance methods, generally a digital identification check or comparison against a third-party identity database, before granting access. It took effect May 3, 2023. Senate Bill 73, enacted in 2026, strengthened the law by treating anyone actually located in Utah as accessing from Utah even when using a VPN or proxy server, by prohibiting covered sites from providing instructions on how to evade the requirement using a VPN, and, separately, by giving Utah's Division of Consumer Protection its own enforcement authority for the first time: administrative fines of up to $2,500 per violation and the ability to bring a court action, in addition to the law's existing private right of action.

One of the VPN provisions is now blocked, however. Aylo, Pornhub's parent company, sued Utah in April 2026 over SB 73's requirement that a VPN user physically located in Utah be treated as a Utah user regardless of the VPN. On September 24, 2026, in Aylo Freesites v. Utah Division of Consumer Protection (D. Utah, No. 2:26-cv-00340), the court preliminarily enjoined only that actual-location provision, Utah Code 78B-3-1002(3), on dormant Commerce Clause grounds. The original 2023 verification duty was not challenged and remains in force. The rest of SB 73, including the Division of Consumer Protection's new enforcement power and the separate rule in 78B-3-1002(4) barring covered sites from facilitating or encouraging VPN use to circumvent age verification, is not part of the injunction. On October 8, 2026 the court stayed the case until the end of the Utah Legislature's next General Session and ordered a joint status report by March 19, 2027.

Both bills are codified in Utah Code Title 78B, Chapter 3, Part 10, "Liability for Publishers and Distributors of Material Harmful to Minors." Utah Code 78B-3-1002 carries the age-verification requirement itself, along with the SB 73 provisions treating a user physically located in Utah as a Utah user regardless of a VPN or proxy server and barring covered sites from facilitating or encouraging VPN circumvention. Utah Code 78B-3-1001 supplies the definitions, 78B-3-1003 the private civil liability, 78B-3-1004 the Division of Consumer Protection's enforcement powers including the administrative fine of up to $2,500 for each violation, and 78B-3-1005 the division's rulemaking authority.

Why Utah's Law Survived: Jurisdiction, Not the First Amendment Merits

Utah's adult-content law survived its court challenge, Free Speech Coalition, Inc. v. Anderson, for a structural reason rather than a substantive one. SB 287 is written as a «bounty» style law with no dedicated state enforcement mechanism, so the federal district court, affirmed by the Tenth Circuit, dismissed the challenge for lack of jurisdiction: there was no state enforcer for the plaintiffs to sue.

That is meaningfully different from Texas's story. In Free Speech Coalition v. Paxton, the Supreme Court actually reached and ruled on the First Amendment question and upheld Texas's law on the merits. Utah's original law is standing today because there was no one to sue, not because a court examined the free-speech question and sided with the state. Readers should not treat Utah's outcome as a substantive win of the same kind Texas achieved.

That "no one to sue" fact pattern is specific to SB 287 as it existed at the time of the Anderson dismissal. Senate Bill 73 (2026) changed it going forward: it gave the Division of Consumer Protection its own administrative-fine and court-action authority over the age-verification chapter, which means Utah now has a real state enforcer where it previously had none. A challenge to the law as amended would not have the same jurisdictional off-ramp Anderson had, and in the 2026 Aylo case against SB 73 the court reached the merits at the preliminary-injunction stage.

Utah's App Store Accountability Act: Delayed a Year, AG Authority Eliminated

Utah was the first state to enact an App Store Accountability Act, Senate Bill 142 (2025), originally set to take full effect May 6, 2026. House Bill 498, enacted in 2026, delayed that date a full year, to May 6, 2027, and separately eliminated the Utah Attorney General's authority to enforce the law. Enforcement now rests solely on a private right of action: an injured minor, or that minor's parent or guardian, may sue an app store or app developer directly. Under Utah Code 13-76-401(1), that suit is available beginning May 6, 2027, the same date as the law's substantive obligations, so there is no earlier window in which a minor or parent may file. That combination, delay plus removal of the state's own enforcement power, is unusual and should not be described as a simple one-year delay.

Once House Bill 498 removed the Attorney General's enforcement authority, the industry challenge to the original law, brought by CCIA, the Computer and Communications Industry Association, became moot on its own terms, and the plaintiffs voluntarily dismissed the case on April 21, 2026. That dismissal followed a legislative fix, not a court ruling on the law's constitutionality.

What Happens When You Visit an Affected Site From Utah

Utah's adult-content law does not ban the material it covers; it requires verification before access. Pornhub's parent company, Aylo, has taken the same approach in Utah that it has taken in Texas, Mississippi, and Arizona: blocking access rather than building a verification system, which is Aylo's own business decision, not something Utah's law requires.

Two Laws, Two Different «Why Is This Standing» Stories

It is worth stating plainly that Utah's two laws survived for different procedural reasons and should not be described as though a court affirmed either one on the constitutional merits. SB 287 stands because there was no state enforcer to sue. The App Store Accountability Act's original challenge was dismissed as moot once the legislature itself removed the Attorney General's enforcement power. Neither outcome is the kind of merits ruling Texas received in Free Speech Coalition v. Paxton.

Verified directly against Utah's official legislative bill pages for Senate Bill 73 (2026) and reporting on the CCIA challenge's voluntary dismissal, current as of 2026-08-13; the September 24, 2026 preliminary injunction was checked against the court's published decision on GovInfo on 2026-09-28. The codified text was read directly on Utah's official code site: Utah Code 78B-3-1002 and the surrounding sections of Title 78B, Chapter 3, Part 10, and Utah Code 13-76-401 for the App Store Accountability Act's enforcement provision.

Related Resources

• Age Verification Laws by State
• App Store Age Verification Laws
• Texas Age Verification Law
• Arizona Age Verification Law

---

Last updated: 2026-09-28.

Frequently Asked Questions

Was Utah's age-verification law upheld by a court the same way Texas's was?

Not in the same sense. Utah's law survived because the challenge was dismissed for lack of jurisdiction, since the law had no state enforcement mechanism to sue over at the time. A court never reached and ruled on the First Amendment merits the way the Supreme Court did for Texas.

Does Utah's law apply to VPN users?

Senate Bill 73 (2026) tried to, but part of it is enjoined. It extended coverage to users physically located in Utah even when they use a VPN and banned covered sites from providing VPN-evasion instructions. In practice, part of that is now blocked: Aylo sued Utah in April 2026, and on September 24, 2026 a federal court preliminarily enjoined only the actual-location provision, Utah Code 78B-3-1002(3), which reaches users physically in Utah even behind a VPN. Utah's original verification duty was not challenged and still applies.

When does Utah's App Store Accountability Act take effect?

Its obligations take effect May 6, 2027, after House Bill 498 (2026) delayed the original May 2026 date by a year. Utah Code 13-76-401(1) sets the private right of action on that same May 6, 2027 date, so no suit is available before then.

Does the Utah Attorney General enforce the App Store Accountability Act?

No, not anymore. House Bill 498 (2026) eliminated the Attorney General's enforcement authority; enforcement now rests solely on a private right of action by injured minors or their parents.

Why was the challenge to Utah's App Store Accountability Act dismissed?

The plaintiffs voluntarily dismissed their case on April 21, 2026, after House Bill 498 removed the Attorney General's enforcement power, which mooted the objections the suit had raised.

Is adult content banned in Utah?

No. Utah's law requires age verification before access; it does not ban the underlying content. Some sites choose to block Utah traffic rather than verify, which is that company's own decision.