TL;DR
Get privacy and security gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A federal judge issued a preliminary injunction preventing Utah from enforcing SB 73’s provisions targeting VPN use while the court case continues. The ruling says the law likely requires covered websites to determine users’ locations with a level of accuracy that is not currently possible, burdening users and businesses beyond Utah.
A federal judge has temporarily blocked Utah from enforcing SB 73’s VPN provisions, agreeing with the challenge that the law likely requires adult websites to determine users’ physical locations with an accuracy current geolocation technology cannot provide. The preliminary injunction applies while a lawsuit brought by Aylo, the parent company of Pornhub and other adult websites, proceeds.
SB 73 requires covered adult websites to block VPN users or identify the physical location of visitors using VPNs and similar tools that mask network traffic. The law also bars covered sites from providing instructions on using a VPN to get around age-verification checks. The injunction concerns the law’s VPN-related requirements; the source report says Aylo’s lawsuit does not challenge the separate prohibition on sharing VPN information.
Judge Barlow found that the law likely places a burden on businesses and people outside Utah, because a website may have to locate every visitor to avoid liability if even one user is masking a Utah location. The court said the provision “in practice requires an entity to perform age verification services for every user visiting its site from any location” when a user might be obscuring their location.
The judge also described the statute as effectively imposing strict liability on companies over users’ locations. Aylo argued that websites would need to geolocate users “with perfection”; the court acknowledged that “geolocation perfection is not presently possible.” The ruling is preliminary, not a final decision on whether SB 73 is constitutional.
Why VPN Location Rules Were Blocked
The ruling addresses whether a state can make websites responsible for identifying users’ locations even when privacy tools conceal the network address a site ordinarily sees. A VPN routes traffic through an intermediary server, so the destination website generally sees the server’s IP address rather than a visitor’s original connection. That can make it difficult to determine whether a user is in Utah or somewhere else.
According to the court’s reasoning, requiring near-perfect location detection could lead websites to verify the age of every visitor, block VPN traffic broadly, or restrict access for Utah users. EFF argues that such responses would affect people outside the state and could pressure sites to collect more user data. Those wider effects are concerns raised by EFF and the legal challenge, not findings that every site has already adopted those practices.
The injunction also matters for the boundary between state regulation and an internet service’s users across multiple jurisdictions. For now, the order prevents enforcement of the challenged VPN provisions while the case continues; it does not settle the law’s ultimate status or invalidate every part of SB 73.
As an affiliate, we earn on qualifying purchases.
How SB 73 Reached Court
Utah enacted SB 73 earlier in 2026, with its provisions initially scheduled to take effect in May. Aylo filed a constitutional challenge, after which the parties agreed that Utah would pause enforcement while the court considered a request for a preliminary injunction or until administrative compliance rules were finalized.
The Utah Department of Commerce’s Division of Consumer Protection published proposed rules, identified as R152-78B, on September 1, 2026. The notice said the rules could take effect as soon as October 8. EFF submitted comments opposing the proposals, including objections to requirements for “commercially reasonable geolocation obfuscation detection systems.” EFF said suggested indicators such as connection latency and device time zones can be unreliable and may wrongly flag users.
EFF described Utah as, to its knowledge, the first state to target VPN use in connection with legally required age-verification gates. The federal court’s injunction now prevents enforcement of the challenged VPN provisions pending further court action, regardless of the proposed rules’ potential effective date.
“The law “demands the impossible.””
— Electronic Frontier Foundation
As an affiliate, we earn on qualifying purchases.
The Injunction Is Not Final
The court has issued a preliminary injunction, not a final ruling that SB 73 is unconstitutional. The case remains pending, and the available report does not provide a date for a final decision or specify what further evidence the court may consider.
It is also not clear from the report how Utah will respond to the order or whether the state will revise its rules or defend the challenged provisions through further litigation. The injunction addresses the VPN requirements at issue in the case; the report says the lawsuit does not challenge the separate restriction on providing VPN-use information.
EFF’s concerns about unreliable detection methods and wider surveillance are arguments in its comments to the Department of Commerce. The judge’s preliminary ruling focuses on the location burden and the apparent impossibility of perfect geolocation, rather than establishing that every concern raised by EFF has occurred in practice.
As an affiliate, we earn on qualifying purchases.
Court Case and Rules Proceed
Utah cannot enforce the challenged VPN provisions while the preliminary injunction remains in effect, pending further action by the court. The next major development will be further proceedings in Aylo’s lawsuit, which could clarify whether the injunction stays in place and whether the court ultimately finds the provisions unlawful.
The Department of Commerce’s proposed rulemaking is also part of the dispute. EFF has submitted comments opposing the rules, but the source report does not say whether the department has finalized or withdrawn them. Any state response, court schedule, or change to the proposal remains to be confirmed.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the federal judge block?
The judge issued a preliminary injunction blocking enforcement of SB 73’s VPN-related provisions while Aylo’s lawsuit proceeds. It is not a final ruling on the entire law.
What does Utah’s SB 73 require of covered websites?
The law requires covered adult websites to block VPN users or identify the physical locations of visitors using VPNs and similar tools. It also restricts those sites from offering instructions on using VPNs to get around age checks.
Why did the judge call the location requirement a problem?
A VPN routes traffic through an intermediary server, meaning a website may see the server’s IP address instead of the user’s original location. The judge said the law appears to demand location accuracy that is not currently possible.
Does the ruling end Utah’s age-verification law?
No. The order is preliminary and addresses the challenged VPN provisions while litigation continues. It does not amount to a final decision on SB 73’s constitutionality.
What happens next?
The court case will continue, and Utah may respond to the injunction or the pending challenge. The status of the department’s proposed compliance rules and the schedule for further court proceedings were not specified in the source report.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
