Federal Judge Blocks Utah’s VPN Age-Verification Law, Citing Constitutional Flaws

A U.S. federal judge has temporarily blocked a Utah law requiring adult platforms to verify user age even if users employ VPNs to mask their location. The ruling, issued on September 24, halts provisions of SB 73 that targeted VPN use, calling them unconstitutional and technically impossible to enforce. The decision arrives as states and advocates clash over the limits of online regulation and digital privacy.

Judge blocks Utah’s VPN age-verification law

U.S. District Judge David Barlow granted a preliminary injunction on September 24 against Utah’s SB 73, a law requiring adult platforms to verify the age of users physically located in the state—even if they used VPNs to mask their location. The ruling blocks the law’s VPN-related provisions, citing constitutional violations and technical impossibility.

According to reports, SB 73 aimed to close a perceived loophole that allowed users, including minors, to bypass age verification by masking their location. The law also prohibited platforms from providing instructions on how to bypass these checks using VPNs, a measure critics argued violated free speech protections.

Judge Barlow’s decision emphasized that "perfect geolocation"—the ability to accurately determine a user’s physical location despite VPN use—does not exist. The ruling suggests the law’s requirements would violate the dormant Commerce Clause by forcing platforms to enforce Utah’s rules beyond its borders.

Constitutional and technical challenges

The court’s decision highlights the tension between state-level regulations and the technical realities of VPNs. VPNs encrypt user traffic and route it through remote servers, making it difficult to determine a user’s physical location. This encryption is widely used by journalists, activists, and businesses to protect sensitive communications.

Utah’s Attorney General Derek Brown’s office reportedly argued that the law did not require "perfection" in location verification, only "reasonable efforts." The judge disagreed, ruling that the state’s demands were unworkable and likely unconstitutional.

Digital rights advocates, including the Electronic Frontier Foundation, warned that the law could force platforms to either break encryption or ban VPN IP addresses globally. Gytis Malinauskas, Head of Legal at Surfshark, reportedly welcomed the ruling, stating that it signals to other states that targeting privacy tools is constitutionally fraught.

Legal battle ongoing

The injunction temporarily blocks only the provisions targeting VPN users. Utah’s broader age-verification law, in effect since 2023, remains intact while the lawsuit—filed by Aylo, the parent company of Pornhub—proceeds. Utah’s Attorney General has not indicated whether an appeal will be filed, but legal observers expect further challenges.

The ruling comes as other states consider similar measures. A recent Day of Action led by Fight for the Future protested global efforts to restrict VPNs under the guise of age verification or online ID checks, framing such laws as threats to privacy and free speech.

Context on VPN regulation

Utah’s SB 73 is part of a broader trend of state-level efforts to regulate VPNs, which are increasingly targeted in debates over online privacy, content moderation, and digital rights. VPNs, which secure user communications by encrypting traffic and routing it through remote servers, have become a flashpoint in discussions about balancing safety concerns with constitutional rights.

Digital rights groups have argued that laws like SB 73 set dangerous precedents by attempting to bypass encryption or restrict anonymity tools. Last year, Fight for the Future organized a Day of Action to protest legislative proposals in the U.S. and abroad that sought to limit VPN usage, warning of potential overreach and unintended consequences for cybersecurity.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This ruling underscores a critical reality for founders and operators: state-level attempts to regulate technology often collide with constitutional limits and technical realities. Utah’s SB 73 sought to close a perceived loophole by targeting VPNs, but the court ruled that demanding "perfect geolocation"—pinpointing a user’s physical location despite VPN use—is both unworkable and unconstitutional.

For startups in cybersecurity, media, or any sector handling sensitive data, the decision is a reminder that laws that ignore technical constraints (like encryption) or overreach beyond state borders (via the dormant Commerce Clause) are vulnerable to legal challenges. The injunction doesn’t just protect VPN users; it sets a precedent that could shape future debates over privacy, free speech, and online safety.

The bigger picture? Policymakers are under pressure to address gaps in online safety, but their solutions often clash with how technology actually works. For operators, this means tracking not just what laws pass, but how they’re tested—and struck down—in court.

Key takeaways

• U.S. District Judge David Barlow blocked Utah’s SB 73, specifically its VPN-related provisions, on constitutional and technical grounds.
• SB 73 required adult platforms to verify user age even if users masked their location with VPNs, a demand the court called impossible.
• The law banned platforms from providing instructions on bypassing age checks via VPNs, raising First Amendment concerns.
• The injunction applies only to VPN provisions; Utah’s broader age-verification law remains in effect.
• Digital rights groups warn the law could have forced platforms to break encryption or impose global age-verification requirements.

FAQ

What does Utah’s SB 73 require?

SB 73 required adult platforms to verify the age of users physically located in Utah, even if they used VPNs to mask their location. It also banned platforms from providing instructions on how to bypass age verification using VPNs.

Why did the judge block the law’s VPN provisions?

The judge ruled that "perfect geolocation"—accurately determining a user’s physical location despite VPN use—is technically impossible. The court also found the provisions likely violated the U.S. Constitution, including the dormant Commerce Clause and First Amendment.

Does this ruling affect Utah’s broader age-verification law?

No. The injunction applies only to the VPN-related provisions of SB 73. Utah’s broader age-verification law, in effect since 2023, remains in force while the lawsuit continues.

What happens next?

Utah’s Attorney General may appeal the decision. The lawsuit, filed by Aylo (parent company of Pornhub), will proceed, and similar legal challenges to state-level VPN restrictions are expected.

Related on Lazyfounder

• Defend VPNs Day of Action Returns as Global Restrictions Escalate
• Surfshark
• Proton
• Electronic Frontier Foundation
• More policy news