On 24 September 2026, U.S. District Judge David Barlow issued a preliminary injunction blocking one piece of Utah’s age-verification regime: the rule that treated anyone physically inside the state as a Utah user even if they were routing traffic through a VPN, proxy or other location-masking tool. The rest of the state’s adult-content age-verification law remains in force. The blocked clause does not.
This reporting is part of the Sex Worker Visibility Project: coverage of the platform and legal systems that decide who can publish, who can be paid, and under what technical conditions independent adult creators and sites must operate. If that work is useful to you, support it on Patreon or Buy Me a Coffee.
Utah first required commercial entities that make a substantial amount of material harmful to minors available online to use reasonable age-verification methods. In practice, large free tube sites responded by blocking known Utah IP addresses. Users who wanted access turned to VPNs. Lawmakers noticed. Senate Bill 73, the Online Age Verification Amendments, added an “actual-location” provision: a person is considered to be accessing the site from Utah if they are actually located in Utah, regardless of whether they use a VPN, proxy server or other means to make it appear otherwise.
Aylo — parent company of Pornhub, YouPorn and related free sites — sued the Utah Division of Consumer Protection and Department of Commerce. The company argued that current technology cannot reliably determine the true location of a user who is deliberately masking it, and that the statute effectively imposed strict liability for failures of geolocation that no commercial method can guarantee. After agreed delays in enforcement, Judge Barlow ruled on the preliminary injunction.
The court held that the actual-location provision is likely to violate the dormant Commerce Clause. Barlow found that the amendment, read as a whole, did not leave room for a “reasonable effort” defence on geolocation. The result was something close to strict liability for entities that could not see through VPNs. Constitutional harm from enforcing a likely unconstitutional provision, he wrote, outweighed Utah’s interest in enforcing it while the case proceeds. The injunction runs only against section 78B-3-1002(3). Nothing in the order stops the state from otherwise enforcing the broader age-verification statute.
That distinction matters. Utah residents who appear on Utah IP addresses are still subject to the original verification or blocking regime. What the state cannot do, for now, is punish a site for failing to age-check a user who is physically in Utah but whose traffic arrives from a non-Utah IP. The Free Speech Coalition called the ruling a significant early win against a technologically unsound rule and urged continued compliance with the rest of the law.
The Utah fight is one node in a larger map. At least two dozen U.S. states have adopted some form of adult-content age-verification requirement. The rules differ on thresholds, methods and liability. Platforms face a choice between state-by-state geoblocking, third-party verification services that collect identity data, or exit from certain markets. Independent creators who rely on those platforms inherit the friction: reduced traffic from blocked states, higher compliance costs passed downstream, and ongoing uncertainty about which technical fix will be treated as “reasonable” next year.
Judge Barlow’s order does not end age verification in Utah. It draws a line at a specific claim: that a state can demand perfect knowledge of a user’s true location through the noise of modern networking tools, and hold a site strictly liable when that knowledge fails. For the Sex Worker Visibility Project, the case is useful because it shows how platform regulation reaches the people who produce the content. Labour conditions online are not only about contracts and payouts. They are also about whether the infrastructure that carries the work can be made to obey rules that technology cannot yet keep.