Utah's VPN Age Verification Law Is Unconstitutional, Says Federal Judge

Key Takeaways

• On September 24th, U.S. District Judge David Barlow granted a preliminary injunction against Utah's SB 73, blocking the law's provisions requiring adult platforms to identify and verify the physical location of users even when they're using a VPN.
• The judge stated the mandates are "likely to violate the United States Constitution" and noted that "perfect geolocation" simply doesn't exist — making the law's requirements both technically impossible and a threat to free speech and privacy.
• The lawsuit was originally filed in May by Aylo, the parent company of Pornhub. The broader age verification law remains contested; Utah's Attorney General may appeal.
• SB 73 also banned websites from providing instructions on how to use a VPN to bypass age checks — a provision that digital rights advocates argued directly targeted the communication of lawful information.
• The ruling sends a signal to other states drafting similar bills: mandatory VPN location tracking can't survive First Amendment scrutiny.

Utah's SB 73 was the first US state law to explicitly target VPN use as part of an age verification framework. It required adult platforms to identify and verify the physical location of all users — including those masking their traffic through a VPN or similar tool — and to deny access to anyone they couldn't confirm was physically located outside Utah, or who couldn't be verified as an adult within it. It also banned platforms from providing instructions on how to use a VPN to bypass the checks.

We covered this law in the context of the VPN Day of Action earlier this week, where Fight for the Future documented Utah as the first US state to meaningfully restrict VPN use — and where we noted that placing enforcement on site operators rather than users creates an incentive to over-block anyone connecting through a VPN, regardless of why they're doing it. The court's ruling engages with exactly that problem.

What the Judge Found

According to TechRadar's reporting, U.S. District Judge David Barlow granted the preliminary injunction on September 24th, finding that the law's mandates are "likely to violate the United States Constitution." The judge's reasoning goes to the technical reality of what the law was demanding. As he noted, "perfect geolocation" doesn't exist. 

A VPN encrypts traffic and routes it through a remote server, hiding the user's true IP address from the websites they visit. Requiring platforms to bypass this encryption to determine a user's physical location isn't just technically unreliable — it's not something websites can guarantee, and attempting to do it creates serious privacy and free speech concerns independent of the age verification goal.

The injunction is preliminary, meaning enforcement is paused while the legal challenge continues. Utah's Attorney General may still appeal, and the broader age verification law remains contested. But the ruling creates a significant obstacle for the law's VPN provisions and establishes a judicial record that similar provisions elsewhere will need to reckon with.

Why This Is More Than a Win for One Company

The lawsuit was brought by Aylo — Pornhub's parent company — and it's easy to frame the ruling as a dispute between a state government and an adult content platform. That framing misses what the law was actually doing.

SB 73's VPN provisions didn't only affect adult content. They required platforms to build infrastructure capable of identifying and geolocating users through encrypted connections — infrastructure that, once built, is not limited to the specific use case that justified it. A platform that can de-anonymize a VPN user for age verification purposes has built something that can be pointed at other questions. The law also banned websites from explaining how VPNs work in the context of age verification — a direct restriction on communicating lawful information about a lawful tool.

Proton's response to the ruling captured the broader point: "VPNs should not be used as a scapegoat. We hope that other states will take notice and draft their child safety bills in a targeted way that does not sacrifice user privacy and security." Surfshark's head of legal had previously described SB 73 as treating "a core cybersecurity tool as an illegitimate workaround" — which is precisely what the law did, and precisely what the judge found the Constitution doesn't permit.

The Precedent and What Comes Next

This ruling matters beyond Utah. States including Michigan have proposed similar VPN bans; Brazil already treats VPN use as an aggravating factor in criminal sentencing; and Russia's escalating crackdown on VPN infrastructure — covered separately this week — shows what the endpoint of that logic looks like when pursued without constitutional constraints.

The judge's finding that perfect geolocation doesn't exist is not just a technical observation. It's a constitutional one: a law that requires the impossible as the mechanism for restricting protected speech fails scrutiny on its own terms. Other states drafting age verification bills with VPN provisions are now writing against a federal court record that says this approach likely violates the First Amendment.

The broader age verification framework in Utah isn't resolved by this ruling, and the legal battle continues. But for the specific question of whether governments can mandate that platforms track, locate, and de-anonymize users who choose to use encrypted privacy tools — the answer from this court is no.