Senate Bill 73, a 2026 amendment that mandates adult websites to confirm users’ ages before allowing access, is at the heart of the most recent chapter. Keeping minors away from explicit content was the obvious goal. However, Utah’s method of enforcing this, and especially one particular clause buried within it, has sparked a federal lawsuit and temporarily halted the law’s implementation.
That lawsuit was filed in April by Pornhub’s parent company, Aylo. Its main contention is that one provision in SB 73 makes compliance practically impossible, not just that age verification is onerous. According to what the lawsuit refers to as the “Deemed-Location Provision,” adult platforms must verify users even if they are using a VPN to conceal their location. According to Aylo’s legal team, the issue is that it is impossible to determine a VPN user’s precise location. Utah or somewhere else. This implies that in order to avoid penalties in a particular state, a platform would actually need to verify everyone on the internet. That isn’t a problem with compliance. It is structurally impossible.
When drafting the bill, Utah’s lawmakers might not have given the VPN aspect enough consideration. They might have also concluded that the platforms should bear the responsibility instead of the state. In any case, the outcome is a law that, according to Aylo, as written creates “a de facto global mandate”—the kind of inadvertent overreach that usually attracts the attention of courts rather quickly.
While a federal judge considers the case, Utah’s Division of Consumer Protection has agreed to temporarily suspend enforcement. A joint stipulated motion extended the pause, which was originally scheduled to end in early September, until September 17. It’s a narrow window, but it shows that while the bigger legal issue is being worked out, both parties are still negotiating on the periphery.
Utah has previously found itself in court due to restrictions on online content. Senate Bill 287 was passed by the state back in 2023, requiring age verification on pornographic websites in general and granting private citizens, not state officials, the right to sue noncompliant platforms. That law was challenged by the Free Speech Coalition and a number of online authors, who claimed that by limiting protected speech, it violated the First Amendment. Because the named state officials were not directly involved in enforcing the law, a federal judge dismissed their case on procedural grounds. The Tenth Circuit received that decision, and it is currently pending.
A 2025 Utah law requiring app stores to confirm users’ ages before permitting downloads is being contested by tech companies. In February 2026, a trade association filed a lawsuit, alleging that the law violates First Amendment rights. As a result, Utah is currently handling at least three different legal challenges to various components of its online age-verification system. They are all traveling through various courts at varying speeds.
Observing all of this gives me the impression that Utah is sincerely attempting to address a genuine issue—children do come across explicit content online at startlingly young ages—but has repeatedly run into the same obstacle. State boundaries are irrelevant on the internet. VPNs and other navigational tools were designed to disregard geography. Any legislation that makes the assumption that it can control access based on location will eventually run afoul of this reality.
Whether the federal court grants a preliminary injunction and how broadly that decision is worded will determine what happens next in the Aylo case. The battle remains local due to a narrow decision. A more widespread one might have an impact on the two dozen or so other states that have recently enacted age-verification legislation. Although it’s still unclear where this will go, it’s something to keep an eye on. Courts have yet to provide a definitive response to the fundamental question of whether a state can effectively control the online activities of its citizens.