Utah’s experiment with tying age-verification rules to virtual private network use has hit the pause button, at least for now. The Utah Department of Commerce has agreed not to enforce SB 73 while a federal judge considers a legal challenge brought by Aylo, the owner of Pornhub. The measure had taken effect on Thursday after an earlier delay, but its practical consequences remain on hold as the case moves through court.

That procedural pause matters well beyond one state, one adult website, or the familiar internet joke about a VPN being a digital trench coat. Utah is the first US state to adopt a law that directly addresses VPN use as part of a broader age-verification framework. The statute does not ban VPNs outright. Instead, it creates obligations and potential exposure for sites whose users employ them, raising difficult questions about location detection, user privacy and whether a website can realistically know where a visitor is sitting.

What Utah’s SB 73 is designed to do

SB 73 was signed into law in March and was initially expected to take effect in May. It was framed as an amendment to Utah’s existing age-verification law, part of a wider legislative push aimed at websites hosting a substantial amount of material considered harmful to minors.

Its key VPN language takes aim at the assumption that a person can use a VPN to appear to be browsing from a different state. The law treats a person physically located in Utah as accessing a site from Utah even if the person is routing traffic through a VPN. It also says that qualifying site operators may not facilitate or encourage the use of a virtual private network.

Those provisions create a distinction worth keeping clear. A VPN itself is not made illegal by SB 73. People and organizations use VPNs for many ordinary reasons, including safeguarding connections on public Wi-Fi, protecting sensitive work traffic, accessing a company network remotely and reducing unnecessary exposure of browsing data. The statute’s pressure instead falls on the websites subject to the age-verification regime and their handling of visitors who may be masking or altering apparent location.

For a sector built around online access, the broader lesson is that internet policy often lands on platforms and services rather than directly on individual tools. That can turn what sounds like a narrow compliance requirement into a system-wide design problem: how does a site distinguish an adult visitor in one jurisdiction from a minor visitor in another, while a location-masking service may blur the signals the site normally receives?

Why the VPN provision has drawn alarm

Digital-rights and privacy advocates have warned for years that age-gating laws could expand beyond age checks and toward restrictions affecting privacy tools. SB 73 has become a particularly close test of that concern because it puts VPN use expressly into the legal framework.

The technical difficulty is straightforward even if the policy debate is not. A website can observe an IP address and use databases to make an estimate about where that address is located. But such estimates are not a flawless record of a visitor’s physical location. VPNs deliberately route traffic through another server, and shared corporate systems, mobile networks and other network arrangements can complicate the picture further.

If a website faces liability based on a visitor’s actual Utah location, but lacks a reliable way to establish that location when a VPN is involved, it may have few low-risk options. It could block known VPN-associated IP addresses. It could ask more visitors to complete age or identity verification. Or it could withdraw access from an area rather than accept uncertainty. Each response may affect people far beyond the group lawmakers intend to address.

The concern articulated by the Electronic Frontier Foundation is that a requirement to identify VPN users’ true locations could lead sites to block VPN traffic broadly or apply intrusive verification to visitors everywhere, including people who are not in Utah.

That is why the case is relevant to the ordinary internet, not merely to adult-content access. A rule that effectively penalizes a service for failing to see behind a VPN connection could discourage websites from accepting privacy-protecting connections at all. A user connecting from a hotel, airport, college campus or shared office may then face a block, a request for personal documentation, or both. The legal question may be rooted in one category of content, but the operational responses could be much wider.

Aylo’s challenge keeps enforcement in limbo

The current pause follows litigation by Aylo, which operates Pornhub. The company has been one of the most prominent opponents of age-verification laws in Utah and elsewhere in the United States. Its stated position has not been that every form of age verification is unacceptable. Rather, it has argued that the systems adopted in the US create substantial risks around privacy and identity theft.

Pornhub has chosen to block access in 25 states instead of complying with certain state age-verification requirements. That response illustrates the hard choices such laws can create for services: build and maintain a verification workflow that satisfies a patchwork of state rules, challenge the law, restrict access, or use some mix of all three.

Utah’s first planned rollout was stopped after the federal challenge began. The Department of Commerce has now agreed again to delay enforcement while the judge evaluates the dispute. At a Thursday hearing, the judge did not commit to a timetable for issuing a ruling. As a result, there is no stated end date for the current enforcement pause.

For Utah residents, site operators and VPN providers, that means the law exists but is not presently being enforced by the state while the litigation is unresolved. It does not settle the constitutional and practical issues raised by SB 73. It simply prevents those issues from becoming immediate enforcement actions before the court has ruled.

What this could mean for online services

Age-verification policy is often discussed as though a website can flick a switch labeled “confirm adulthood” and call it a day. In practice, compliance can involve collecting data, selecting verification vendors, managing security risk, responding to false results and deciding what to do with users who do not or cannot complete a check. Adding location uncertainty and VPN traffic can make every one of those questions more complicated.

There is also a significant difference between proving that someone is old enough and proving where that person is physically present at a particular moment. A service may be able to ask for information intended to establish age while still being unable to confidently determine real-world location. SB 73’s approach places those concepts next to each other, and the pending case may help define how far that combination can go.

The potential effects are not limited to specialized sites. Internet companies commonly operate across state lines and serve visitors from multiple countries through the same technical infrastructure. A rule in one state can produce broader product decisions if building a state-only compliance system is unreliable or expensive. That dynamic is familiar to game players, too: regional restrictions, account-country mismatches and location-based storefront rules can make digital access feel less like a borderless network and more like a maze with invisible walls.

Gaming audiences already encounter the privacy-versus-verification trade-off in different forms, from account recovery and parental controls to anti-cheat systems and payment checks. The Utah dispute is not about games, but it highlights a principle that carries across digital services: requirements intended to identify or protect a particular group can change the experience for everyone who connects.

For more on how emerging digital platforms are working through shared online spaces and new hardware, see our coverage of Venice Immersive’s focus on XR, smart glasses and social experiences.

The questions a court ruling may clarify

A ruling in the Aylo challenge could address the immediate status of Utah’s SB 73, but its real significance may be in the boundaries it draws. Whether Utah can impose these obligations, how clearly the statute communicates what websites must do, and what legal burden it may place on online speech and privacy tools are all central stakes in the dispute.

  • Location: Can a state require a site to treat a person as in-state despite a VPN, and what evidence would satisfy that obligation?
  • Website responsibility: How much accountability can be placed on a platform for a user’s decision to use a VPN?
  • Privacy: Would the compliance pressure encourage broader identity checks or blocks affecting lawful users?
  • Practicality: Is there a workable technical path that meets the law without treating VPN users as inherently suspicious?

Until the court answers at least some of those questions, Utah’s first-of-its-kind VPN-related enforcement mechanism remains inactive. The case is a reminder that laws built around online safety can quickly become laws about the architecture of the internet itself: who must identify whom, what data gets requested, and whether using a standard privacy tool changes what services a person can reach.