Federal judge blocks Utah SB 73 anti-VPN law as technically impossible

A federal court stops Utah's anti-VPN law

A federal judge has temporarily blocked enforcement of the VPN provisions of SB 73, Utah's law requiring adult websites to detect and block visitors who mask their network location, according to the Electronic Frontier Foundation. The EFF, which has opposed the law both in court filings and in formal comments to state regulators, reported that Judge Barlow issued the preliminary injunction in the week before its October 1 account of the decision.

What SB 73 required

Signed earlier in 2026 and originally scheduled to take effect in May, SB 73 placed two obligations on adult platforms with respect to VPNs and similar traffic-masking tools: either block visitors using them, or determine those visitors' physical location. It also barred covered sites from publishing instructions on using a VPN to slip past the state's age-verification gates, which made Utah, as far as the EFF is aware, the first US state to legislate directly against VPN use for that purpose.

The constitutional challenge came from Aylo, the parent company of Pornhub and other adult platforms. Enforcement was paused by agreement while the injunction request was pending, though Aylo's suit does not contest the restriction on telling users about VPNs.

The court's reasoning

According to the EFF, Judge Barlow found the law likely violates constitutional limits on state legislation that heavily burdens people and businesses beyond the state's borders. Because a site cannot know which visitors are hiding their location, the only safe path is to age-verify everyone, everywhere. The court wrote that the statute in effect imposes strict liability, requiring operators to geolocate users “with perfection,” while acknowledging that “geolocation perfection is not presently possible.”

The judge put a number on the consequence: Aylo would have to verify its roughly 28 million users, whether they live in Salt Lake City, Boston or Honolulu, to avoid breaking the law.

The technical reality

The EFF's filings explain the underlying problem. VPNs forward traffic through intermediary servers, so a destination website sees only the VPN server's address and has no reliable way to tell whether a connection originates in Utah, another state, or another country. Operators are left choosing between blocking all VPN traffic nationwide or withdrawing from Utah entirely.

Utah's proposed compliance rules (R152-78B), published by the Department of Commerce's Division of Consumer Protection on September 1, would have required “commercially reasonable geolocation obfuscation detection systems.” In its formal comments opposing them, the EFF argued that the suggested detection methods, such as monitoring connection latency or device time zones, are notoriously unreliable under ordinary network conditions, and would produce widespread misclassification, wrongful access blocks and surveillance of users well beyond Utah's borders.

What happens next

Those rules could have taken effect as soon as October 8, but the injunction prevents enforcement pending further action by the court. The EFF notes that Utah legislators have indicated they may rewrite the law in the next session, and warns that other states are weighing comparable anti-VPN proposals. The group argues that VPN services and obfuscation tools will simply adapt, as they have in heavily censored regions, making the framework unsustainable in practice.

Why it matters

The ruling is a significant judicial check on age-verification laws that reach for the impossible. If one state can oblige every website to verify the ages of all visitors worldwide, just in case a single user turns out to be in that state, the practical result is a global compliance regime built by a single legislature. The decision signals that courts will weigh technical feasibility, since perfect geolocation cannot be legislated into existence, alongside the extraterritorial burden such laws impose. It also protects ordinary VPN use, which for millions of people is a standard security and privacy tool rather than a workaround for age gates. With other states watching Utah, the injunction may shape how far privacy-hostile enforcement of technical protocols can go.