Utah pauses its VPN law, but only for Pornhub's owner
Utah has agreed not to enforce the part of its Utah VPN law that decides where a user is located, but only against one company. On 4 September 2026 the state's Department of Commerce confirmed a stipulation with Aylo Freesites, the owner of Pornhub, filed in federal court: the deemed-location provision of Senate Bill 73 stays unenforced against Aylo until the state's own rule takes effect or the judge rules on Aylo's request for a preliminary injunction, whichever comes first. Reporting puts that outer date at 22 October.
In short
- The pause is an agreement between the state and one company, not a court ruling striking the law down.
- It covers only Aylo, and only while Aylo keeps blocking its sites inside Utah.
- Every other site covered by SB 73 is still exposed to enforcement, at 2,500 dollars per violation.
What exactly was paused in the Utah VPN law
SB 73, formally the Online Age Verification Amendments, does not ban VPNs. Its disputed clause says that a person physically present in Utah counts as a Utah user even when a VPN, a proxy or any other tool makes the connection look like it comes from somewhere else. That is the deemed-location provision, and it is the first time a US state has written VPN use into the text of a law rather than left it as a gap.
The state was blunt about how narrow the pause is. Its statement reads: "This agreement is strictly limited to Aylo and is contingent upon Aylo maintaining its geofencing restrictions within Utah." In other words, the company that gets the reprieve is the one that already blocks Utah visitors at its own door. Aylo, for its part, told the court it considers the proposed rule flawed but that the forbearance lets it take part in the rulemaking.
- SB 73 is signed, with an effective date of 6 May.
- Aylo Freesites and Aylo Group sue Utah over the deemed-location provision.
- The parties agree the state will not enforce that provision against Aylo for 120 days, through 3 September.
- Judge David Barlow hears the preliminary injunction arguments in US District Court and does not rule.
- The Division of Consumer Protection proposes rule R152-78B; comments run to 1 October, the rule is expected to take effect 8 October.
- The forbearance is extended, reported as running to 22 October or an earlier ruling.
What the agreement does not change
Paused
- Deemed-location clause against Aylo
- Only while Aylo geofences Utah
- Only until the rule or the ruling
Still in force
- The rest of SB 73
- Enforcement against every other site
- 2,500 dollars per violation
The law reaches commercial sites where more than a third of the material counts as harmful to minors, and it makes them verify the age of Utah users. Nothing in the September filing removes that duty, and nothing in it answers the constitutional question. Judge Barlow still has the preliminary injunction motion in front of him, and the state is still writing the rule that will say how the deemed-location clause is applied in practice.
Why the deemed-location clause matters beyond adult sites
The clause shifts the burden in a way that reaches ordinary users. A site cannot see through a VPN, so a rule that holds it responsible for the real location of its visitors pushes it toward one of two answers: verify everyone more aggressively, or treat VPN traffic as suspect and block it. Both answers land on people who use a VPN for the usual reasons, on hotel and airport networks, on a work connection, or simply to keep an internet provider out of their browsing.
That is why privacy vendors reacted rather than the adult industry alone. Denis Vyazovoy of AdGuard called VPNs "general-purpose privacy and security tools", and Gytis Malinauskas of Surfshark warned that the approach could "erode the privacy of ordinary users". Utah is also not alone in trying: similar age verification bills elsewhere have circled the same problem, and this case is the first test of what happens when a state names the tool in the statute. We covered the law itself when it passed, in Utah's first VPN-targeting law.
Other states are watching for a practical reason. Age verification laws have already reached federal courts elsewhere, and at least one of them was blocked before it could be enforced, so legislators drafting the next version are waiting to see which wording survives. If Judge Barlow lets the deemed-location clause stand, the sentence about VPNs and proxies becomes a template that can be copied into the next bill; if he strikes it, the same drafters will look for another way to write the same requirement without naming the tool.
