A federal judge has stopped Utah from enforcing a law that would force websites to know where every user sits in the world. The law, signed into law earlier this year, would have required platforms to block users connected through virtual private networks, or to work out the physical location of every person who visits. The court found that demand impossible to meet and said it likely breaks the Constitution.
The ruling comes after Aylo, the parent company of Pornhub and other major adult platforms, challenged the law in May 2026. Utah and Aylo agreed to put enforcement on hold while the court heard the request for a preliminary injunction. Judge Barlow issued that injunction last week, finding that the law’s demand for perfect geolocation is technically impossible and that enforcing it would burden businesses and people outside Utah’s borders.
What the law actually said
Utah’s SB 73 law went beyond banning the use of Virtual Private Networks on adult websites. It also made it illegal for websites to offer instructions on how to use a VPN to get around legally required age-verification checks. Utah became, to EFF’s knowledge, the first state aiming directly at the use of VPNs to avoid those checks.
The law’s central demand was a provision that required platforms to either know every visiting user’s physical location and block those in Utah, or verify every visitor’s age just in case they might be in Utah. The court wrote that the law’s “actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating.”
Judge Barlow noted that the statute “essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users.” He also said the statute requires “perfection in the absence of perfect geolocation tools” and acknowledged “that geolocation perfection is not presently possible.”
Why EFF said the law can’t work
EFF submitted formal comments to the Utah Department of Commerce’s Division of Consumer Protection opposing the proposed rules. The group argued that the law compels a technical impossibility.
The comments explained that destination websites only see the IP address of a VPN server and cannot reliably work out a user’s actual location. That means a platform cannot know whether a visitor is sitting in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu.
Aylo would need to verify 28 million users to ensure compliance and avoid liability, according to Judge Barlow. The court’s decision means the proposed rules, published on September 1st, cannot be enforced pending further action by the court.
The detection heuristics don’t help
The Department’s suggested detection methods, like monitoring connection latency or device time zones, are unreliable and easily skewed by normal network conditions, leading to widespread misclassification and unwarranted access blocks.
Judge Barlow acknowledged the problem. He said the statute requires “perfection in the absence of perfect geolocation tools” and that “geolocation perfection is not presently possible.”
What happens next
The ruling stops enforcement of the law’s VPN provisions pending further action by the court. The proposed rules, published by the Division of Consumer Protection on September 1st, could have been effective as soon as October 8, 2026, but Judge Barlow’s decision means they cannot be enforced.
The case is a reminder that the law cannot force what technology cannot deliver. A law that asks the impossible is not a law at all.
EFF’s position was simple: the law asks websites to do something that is physically impossible. The court agreed.
Key dates in the case
- The law was signed into law earlier this year.
- Aylo filed a constitutional challenge in May 2026.
- Utah and Aylo agreed to pause enforcement pending the preliminary injunction request.
- The proposed rules were published on September 1st.
- The rules could have been effective as soon as October 8, 2026.
- Judge Barlow issued the preliminary injunction last week.
| Event | Date |
|---|---|
| Law signed into law | Earlier this year |
| Aylo files constitutional challenge | May 2026 |
| Utah and Aylo agree to pause enforcement | Pending the preliminary injunction request |
| Proposed rules published | September 1st |
| Rules could be effective | October 8, 2026 |
| Judge Barlow issues preliminary injunction | Last week |
Where the paper stands
The paper backs Aylo and is against Utah’s geographic filtering law, which the court found likely unconstitutional. The ruling stops enforcement of the law’s VPN provisions pending further action by the court. Judge Barlow found that the law’s demand for perfect geolocation is technically impossible and that enforcing it would burden businesses and people outside Utah’s borders.
The law would have forced a handful of large platforms to verify the age of millions of users, a task the court called technically impossible. The judge noted that the statute “essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users,” and that “geolocation perfection is not presently possible.”
The paper supports narrow rules against direct harm, such as forcing companies to disclose safety failures they hid, and opposes broad rules that hand the market to the incumbents. A rule that only the largest firms can afford to follow is not a safeguard — it is a moat. Utah’s law would have locked out smaller platforms entirely, leaving the biggest firms the only ones left standing.
Source material: “Court agrees with EFF: Utah's VPN law demands a technical impossibility,” eff.org.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.