A US federal judge has blocked key parts of a Utah law that would have required adult websites to pinpoint the physical location of visitors using a VPN, ruling that the state was demanding a level of location accuracy that simply does not exist, as first reported by TechRadar.
The law, Utah’s SB 73, updated the state’s existing online age verification rules so that adult platforms had to identify and verify the age of any visitor physically located in Utah, including those connecting through a VPN. The legislation also barred sites from publishing instructions that told visitors how to use a VPN to get around the age checks in the first place.
US District Judge David Barlow granted a preliminary injunction against the VPN provisions on 24th September, finding them likely to breach the US Constitution. According to the Electronic Frontier Foundation (EFF), which backed the challenge, Judge Barlow wrote that “geolocation perfection is not presently possible” and that the law effectively imposed strict liability on platforms for a technical feat no one can reliably perform.
VPNs work by routing traffic through intermediary servers specifically to obscure a user’s real location, so any system built to defeat that at scale would also have to defeat the basic purpose of using a VPN.
The EFF, publishing its own analysis of the ruling on 1st October, said the decision recognises that states cannot use age verification as a backdoor to mandate blanket location tracking or to undermine security tools that millions of people rely on for entirely legitimate reasons.
The case was brought on behalf of Aylo, the company behind Pornhub and several other adult sites, which argued it could not comply with the law without either blocking all VPN traffic outright or attempting an unreliable and privacy-invasive form of surveillance.
The ruling only blocks the VPN-specific provisions for now, and Utah’s wider age verification regime remains in force. State lawmakers could attempt a revised version of the rule in a future legislative session, and an appeal of the injunction is possible.
The case lands at a moment when UK readers are grappling with similar questions much closer to home. Age verification under the Online Safety Act has already pushed a wave of UK users towards VPNs to access content blocked by ID or facial age checks, and VPNCompare has previously covered why age verification measures struggle to actually stop VPN users.
The Utah ruling does not change UK law, but it adds to a growing body of US case law suggesting that laws built around identifying a VPN user’s “real” location are difficult to defend once they reach a court that understands how the technology works.
For anyone using a VPN for ordinary privacy and security reasons rather than to dodge age checks, the case is a useful reminder that not all VPNs are treated equally by regulators or by the sites they are used to reach. Choosing a provider with a strong, independently audited no-logs record and a history of standing up to legal pressure in multiple jurisdictions matters more than ever.
Whether other states follow Utah’s approach, or instead look to the outcome of this case as a warning, is likely to shape the next round of US age verification legislation heading into 2027.
