A federal judge paused enforcement of a specific clause in Utah’s age laws on September 24, 2026, and the distinction between that clause and the rest of the statute matters more than most headlines suggest. The ruling does not eliminate Utah’s age-verification regime. It blocks one provision while the underlying legal fight continues.
U.S. District Judge David Barlow of the District of Utah granted a preliminary injunction in favor of Aylo Freesites Ltd. and Aylo Group Ltd., the parent companies behind Pornhub, who filed suit against Utah consumer-protection and commerce officials on April 22, 2026. The injunction targets Utah Code § 78B-3-1002(3), known as the “actual-location” provision, which treated any user physically in Utah as a Utah user regardless of whether a VPN or proxy server made their connection appear to originate elsewhere.
One Clause, Not the Whole Law
The injunction pauses a single provision; it does not disturb Utah’s core age-verification requirements.
Before the ruling, covered websites faced potential liability if a Utah resident used a VPN to mask their location and slipped through without age verification. That exposure was central to Aylo’s lawsuit. Judge Barlow’s order removes that specific liability hook while litigation proceeds, but the injunction targets only § 78B-3-1002(3) and does not, on the materials reviewed, enjoin the core age-verification requirement or the separate anti-circumvention provision.
The Impossible Geolocation Standard
The court found that Utah’s provision demanded a level of location certainty that available technology cannot reliably deliver.
Judge Barlow’s reasoning centered on the dormant Commerce Clause. He applied the Pike balancing test to weigh the provision’s local benefit against its burden on interstate commerce. The court concluded that Aylo was likely to show the burden was clearly excessive. The statute effectively demanded certainty about a user’s physical location that no existing technology can provide.
“Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users.” U.S. District Judge David Barlow
Think of it like asking a GPS app to confirm whether someone is standing in a specific state, then holding the app legally responsible if the signal bounces. IP addresses, VPN endpoints, and device settings can suggest location, but tracking users with the certainty the statute required proved technically impossible. The court noted that the statutory text did not clearly limit the location-determination obligation to “reasonable” efforts, which left covered platforms facing strict liability with no reliable technical path to compliance.
The court rejected Aylo’s separate argument that the provision constituted impermissibly extraterritorial legislation. Judge Barlow did not rule on the Foreign Commerce Clause claim.
Age Checks Still Required
Utah’s permitted verification methods and its prohibition against circumvention tools both remain in force.
Utah’s underlying mandate that covered websites use reasonable age-verification methods was not affected by the injunction. The law still permits verification through digital identification, commercial databases used for age or identity purposes, and transactional records connected to mortgage, education, or employment information. The separate prohibition against websites providing tools or instructions that help users circumvent age verification through VPNs or proxy servers also remains on the books , a dynamic also seen in debates around the use of a surveillance app to sidestep state-level oversight.
This preliminary injunction is not a final constitutional verdict on Utah’s law.
The case now moves toward a full ruling. That ruling could determine whether states can legally require websites to identify users’ physical locations despite VPN obfuscation, and whether such requirements survive dormant Commerce Clause scrutiny. The outcome may be relevant to other platforms facing similar state-level age-verification laws. The internet’s architecture has no state lines built in, and this case is forcing courts to decide how far state law can reach across that boundary.
