Utah Pauses Enforcement of First-in-Nation VPN Age-Verification Law Pending Federal Ruling

State regulatory authorities in Utah have agreed to a temporary stay on enforcing a groundbreaking law that penalizes websites when visitors use virtual private networks to bypass local age restrictions. The Utah Department of Commerce confirmed that it will hold off on executing the statutory measures pending a ruling from a federal district judge in an ongoing legal challenge, as first reported by Engadget.

The law, officially designated as Senate Bill 73, was enacted by the Utah state legislature earlier this year as part of a broader statutory push aimed at regulating online adult content. Positioned by lawmakers as a series of formal amendments to the state's existing age verification mandates, the measure makes Utah the first state in the nation to pass legislation explicitly targeting VPN usage in connection with digital content restrictions.

Under the explicit provisions of SB 73, any individual who is physically present within the geographic boundaries of Utah is legally categorized as accessing a website from inside the state, irrespective of whether they are utilizing a VPN or proxy server to conceal their actual physical location. Furthermore, the statute mandates that web publishers hosting a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network to circumvent local access controls.

While SB 73 stops short of instituting an absolute prohibition on individual VPN ownership or usage—a regulatory concept that has been suggested in some jurisdictions introducing age-gating legislation—it creates explicit legal liability for website owners based on their visitors' network configurations. This posture has alarmed technology companies, legal experts, and digital rights organizations, who argue that forcing platforms to detect and block masked connections creates an untenable standard for internet operations.

Privacy advocacy groups have long warned that expanding state-level age verification statutes would inevitably lead to restrictions on privacy-preserving technologies like VPNs, generating severe unintended consequences for everyday internet users rather than solely impacting minors attempting to evade location filters. The legal structure of Utah's SB 73 appears to realize those concerns by forcing online platforms to make difficult choices regarding how they handle anonymous or encrypted web traffic.

In a public analysis published in April, the Electronic Frontier Foundation detailed the technical and practical dilemma web operators face under the law. The digital rights organization explained that if an internet platform cannot dependably identify a user's actual geographic origin, the risk of state liability could push the operator to either completely block all IP addresses associated with known VPN providers or mandate strict age verification for every visitor on a global scale. The foundation emphasized that such compliance measures would subject millions of web users to invasive identity checks or outright access blocks regardless of where they actually live.

The statutory measure was originally signed into law in March with an initial effective date set for May. However, the rollout was suspended after Aylo, the parent company that operates adult site Pornhub, launched a federal legal challenge contesting the law. Utah state officials previously agreed to hold off on enforcement while the court reviewed the lawsuit, and state attorneys reiterated that pause during a court proceeding on Thursday. The federal judge presiding over the case stated during the hearing that he could not commit to a specific date for issuing a final ruling, keeping the enforcement status of SB 73 on hold for the foreseeable future.

Aylo and its subsidiary Pornhub have been among the most vocal corporate entities fighting the recent wave of state-level age verification statutes enacted across the country. The company has clarified that it does not object to all potential forms of age validation, but maintains that the specific legislative frameworks passed by U.S. states create a substantial risk of identity theft, severe data security vulnerabilities, and widespread user privacy violations. Rather than submitting to these state-level mandates and establishing identity checks, Pornhub has completely terminated service access for users across 25 U.S. states.