A federal judge has issued a preliminary injunction blocking enforcement of a Utah law requiring adult content providers to verify the ages of in-state visitors using a virtual private network (VPN) to hide their location. The injunction was sought by the parent company of Pornhub, YouPorn, and other adult websites, which claimed that current technology made it impossible to pinpoint the location of its users masking their locations using VPNs, proxy servers, or similar tools.
While the Sept. 24 injunction issued by the Utah federal court blocks enforcement of the amendment addressing visitors who use VPNs or similar location-masking tools, it left the rest of the state’s 2023 law in place, requiring adult content providers to verify the ages of visitors located in Utah. The injunction applies to a 2026 amendment specifying that the age verification requirement applies to visitors located in Utah, regardless of whether they are using technologies like VPNs that make it appear they are located in other states or countries.
The injunction is not a final decision in the case, but the owner of popular adult websites appears to have a good chance of success in its claims that the amendments are unconstitutional. The judge concluded that the company would likely succeed because the lack of precise geolocation technology for VPN users means the Utah law is likely to impact out-of-state visitors to its adult websites.
The plaintiffs were Aylo Freesites LTD and its parent company, Aylo Group LTD, which operate a number of adult-entertainment websites. The plaintiffs (collectively referred to as “Aylo”) contend that the company faced strict liability for violating the amendment whenever an individual in Utah accessed adult content without having their age verified, even when the company did not know their actual location. Utah maintained that the statute does not require adult website operators to establish the actual location of every visitor, only that operators make reasonable efforts to determine whether the visitor was in Utah.
Compliance Is Technologically Impossible
U.S. District Judge David Barlow found the text of Utah’s 2026 amendment does not include any provision allowing adult websites to avoid liability for violating age verification requirements by making a reasonable effort to establish the location of visitors to their websites. The statute also requires “geolocation perfection” when it comes to ascertaining the location of visitors to a website when the technology does not exist to detect VPN or proxy users or to geolocate those users, he said.
Because the amended statute would directly regulate interactions with website visitors using VPNs who may not have a connection to Utah, it likely violates the U.S. Constitution’s Dormant Commerce Clause by creating too much direct regulation of out-of-state conduct, Barlow explained. The Dormant Commerce Clause is an implied doctrine that bars states from enacting laws that discriminate against or excessively burden interstate commerce.
The judge rejected Utah’s claim that Aylo could use reasonable methods to detect location-hiding technologies and use other factors to determine a user’s physical location with a high degree of reliability, even if those methods were less than perfect. Barlow noted that both parties acknowledged that location-detecting technology increased the likelihood that an adult platform could find a user’s location. However, their experts agreed that no method of determining a user’s physical location on the internet is entirely accurate and location information is subject to manipulation.
Court Applies ‘Pike’ Balancing Test
Barlow also found Utah’s statute may violate the Dormant Commerce Clause because it appears to be excessive under the balancing test the U.S. Supreme Court laid out in Pike v. Bruce Church, Inc. Under Pike, a plaintiff may win a Dormant Commerce Clause challenge if they can show the burden imposed on interstate commerce is excessive in relation to the local benefits.
Utah’s actual-location requirement likely fails the Pike balancing test due to two unusual factual considerations:
- The amended statute requires an unattainable level of perfection in providing the geolocation of users, which will burden interstate commerce outside of the state.
- Utah’s arguments that a reasonable effort standard should be applied essentially concedes that the state’s interests could be served with legislation that only requires a reasonable effort to comply and impose less of a burden on interstate activities.
“All in all, Aylo has shown it is substantially likely to succeed on the merits of its claims that the actual-location provision facially violates the United States Constitution’s dormant Commerce Clause,” Barlow concluded.
Geolocation Limits Shape the Ruling
The judge gave a great deal of weight to Aylo’s argument that the technology for unmasking the location of users using VPNs or similar tools is not accurate enough to ensure Utah’s laws are only being applied to state residents. In the short term, this could provide an avenue for challenging similar statutes requiring adult content sites to accurately establish the location of VPN users. However, future advances in technology could improve the tools available to website owners, so this argument may only apply until geolocation technology improves.
