Published September 29, 2026

Utah tried something no other state had done. Its new age-verification rules didn't just tell adult websites to check the age of people in Utah. They told them to check the age of anyone physically in Utah, even if that person was connecting through a VPN that made them look like they were in Texas or Toronto.

On September 24, a federal judge put that part of the law on hold. His reasoning is worth reading even if you never go near the sites the law is aimed at, because it says something plain about the internet as a whole: no website can know exactly where you are.

What Utah's SB 73 Age Verification Law Actually Required

Utah has had an age-verification law for adult sites since 2023. Pornhub's parent company, Aylo, responded back then by blocking Utah entirely. Anyone with a Utah IP address got a message instead of the site. Plenty of people just turned on a VPN, and VPN searches in the state jumped almost overnight.

SB 73, signed by Governor Spencer Cox in March 2026, was meant to close that gap. The key changes:

• A person counts as accessing a site "from this state" if they are actually located in Utah, no matter whether they use a VPN, a proxy or anything else.
• Covered sites can't "facilitate or encourage" using a VPN to get around age checks. That includes simply publishing instructions.
• A separate 2% tax on adult content transactions.

Before SB 73, blocking known Utah IP addresses was enough. After it, a site could be liable for a visitor in Salt Lake City who showed up with a Denver IP.

Why the Judge Blocked It

Aylo sued, and U.S. District Judge David Barlow granted a preliminary injunction against the "actual location" provision. The core problem, as he saw it, is that the law quietly demanded something that can't be done. To stay safe, a site would have to geolocate every visitor with perfection, and it's undisputed that technology capable of that doesn't exist.

Utah's Attorney General argued that sites would only need to make a reasonable effort. The judge wasn't persuaded, pointing out that courts have to look at the law the Legislature actually wrote, not at how the AG says he'd enforce it. The text doesn't say "reasonable." As written, it comes close to strict liability for getting a user's location wrong.

He found Aylo likely to win on the dormant Commerce Clause, the constitutional rule that stops a state from putting excessive burdens on commerce that crosses state lines. If the only way to be sure you're not serving a Utah user is to age-verify everyone in the country, Utah is effectively setting the rules for all 50 states.

How Websites Actually Guess Where You Are

The interesting part of the case is the state's proposed workaround. Utah argued that sites could combine several clues: your time zone, your browser language, your currency, your account history. In the state's words, a Utah user "would be unlikely to have their time zone set to India, browser language set to Hindi, and their transaction currency set to rupees."

That's true, and it's also exactly why the approach falls apart. Here's what a website really has to work with:

• Your IP address. This is the big one. IP geolocation databases map addresses to a rough area, usually the city or region where your ISP routes traffic, not your home. With a VPN, the site sees the VPN server's address instead of yours. Check what yours says on the homepage.
• VPN detection. Sites can flag IPs that belong to data centers or known VPN servers. But spotting a VPN only tells them the IP isn't really you. It says nothing about where you actually are.
• Browser settings. Time zone and language are easy for a site to read. They're also the same for everyone in Colorado, Arizona, Idaho and the rest of the Mountain time zone, and pretty much everyone in the US uses English and dollars. At best they rule out India, not Idaho.
• WebRTC and DNS leaks. A misconfigured VPN can accidentally reveal your real IP through the browser or your DNS lookups. That's a bug on your end, and it's not something a law can count on. The WebRTC Leak Test and DNS Leak Test show whether it's happening to you.
• GPS. Only with your permission, and nobody's granting that to get past an age check.

Stack all of that together and you get a decent guess about a lot of people, and a very wrong guess about some. For a site facing liability every time it guesses wrong, "decent" isn't good enough.

Why This Matters Beyond Utah

Age-verification laws are spreading fast, and lawmakers in several states have floated VPN restrictions alongside them. Utah's was the first to reach the books, so this case is being watched as a test of whether VPN-targeting language can survive in court at all. For now, the answer looks like no, at least not when it demands a level of certainty the technology can't deliver.

There's a privacy angle here too. The only way to get close to "perfect" location would be for sites to collect much more about every visitor: more fingerprinting, more cross-checking, more stored data. That would hit everyone, not just the people the law was aimed at. Sites already piece together a surprising amount from your browser alone, and the browser fingerprint breakdown shows exactly what.

See What Websites See About You

You don't need to be in Utah to find this useful. Try it with the VPN off and then on:

1. Open the homepage and look at the Location, ISP and Timezone rows. That's roughly what any website sees.
2. Turn your VPN on and reload. The location should jump to wherever your VPN server is.
3. Open the Security tab. If it flags a DNS, WebRTC or IPv6 leak, your real location may still be getting through.

If something leaks, the guide on testing your VPN for DNS, WebRTC and IPv6 leaks walks through fixing each one.

Judge Barlow's ruling comes down to something people who work with networks have known for years. An IP address tells you where a connection comes from. It doesn't tell you where the person is, and a law can't make it.