Utah Pauses Enforcement of First-in-Nation VPN Age-Verification Law

Utah has agreed to temporarily stop enforcing a pioneering law that targets the use of Virtual Private Networks (VPNs) to bypass age verification for adult content. The decision by the Utah Department of Commerce comes as the state awaits a federal court ruling on a legal challenge brought by Aylo, the parent company of Pornhub.

SB 73 marks the first time a U.S. state has specifically targeted VPN usage as a mechanism to enforce age-gating. Under the law, websites that host material deemed harmful to minors are prohibited from facilitating or encouraging the use of VPNs to evade age checks. Rather than banning the tools themselves, the legislation shifts legal liability to the website operators if users within the state utilize VPNs to circumvent verification requirements.

The Legal Battle

The enforcement pause is a direct result of the lawsuit filed by Aylo. The legislation was passed in March as an amendment to existing age-verification laws designed to restrict minors' access to adult material. This move is part of a wider national trend where several U.S. states have implemented strict verification mandates. In response to these compliance risks, some platforms, including Pornhub, have already opted to block access entirely in 25 different states.

Privacy and Industry Implications

This case highlights a growing conflict between state-mandated safety laws and digital privacy tools. The Electronic Frontier Foundation (EFF) has warned that such laws create an untenable environment for website operators. According to the EFF, if a site cannot reliably detect a user's true location and the law requires it to do so for all users in a specific state, the legal risk may force operators to either ban all known VPN IP addresses or mandate identity verification for every visitor globally.

Such a shift would effectively undermine the utility of VPNs for all users, regardless of whether they are attempting to evade age restrictions or protect their general digital privacy. By placing the burden of enforcement on the platform, the law creates a systemic incentive for sites to implement the most restrictive access controls possible to avoid state penalties.

What's Next

The current pause remains in effect until a federal judge issues a ruling on the legality of the VPN-related provisions. While the core of the dispute centers on the liability of website operators, the outcome will likely set a precedent for how other states approach the intersection of encryption, privacy tools, and age-verification mandates. For now, the industry awaits a judicial determination on whether state governments can legally penalize platforms for the use of third-party privacy software by their visitors.