Federal Judge Blocks Utah's VPN Age-Verification Provisions

A federal judge has temporarily blocked key parts of Utah's age-verification law, SB 73, which had sought to require adult platforms to verify the ages of users in the state even when those users connected through a VPN. According to TechRadar, U.S. District Judge David Barlow granted a preliminary injunction on September 24. The lawsuit was filed in May by Aylo, the parent company of Pornhub.

The judge's memorandum said the state's mandates were "likely to violate the United States Constitution," TechRadar reported. The decision focused on provisions that would have forced platforms to determine a user's physical location despite VPN use. As TechRadar noted, citing KUER, Judge Barlow observed that "perfect geolocation" does not exist.

The technical issue is central. A VPN encrypts a user's traffic and routes it through a remote server, masking the user's IP address from websites. Requiring platforms to see through that encryption to establish a user's actual location is not something websites can reliably guarantee, according to the report. The same requirement also raises privacy and free speech concerns.

Utah lawmakers had argued that the law was meant to close a loophole that teenagers could use to reach restricted content. But cybersecurity experts and digital rights advocates warned that forcing platforms to break or block encrypted traffic could endanger journalists, activists, and ordinary users who depend on VPNs to shield data from hackers, stalkers, and corporate tracking.

Industry figures had opposed the measure before the ruling. Gytis Malinauskas, head of legal at Surfshark, previously told TechRadar that VPNs are a standard security tool used by millions of Americans, and that blocking them would weaken ordinary users' privacy. A Proton spokesman told TechRadar the company was encouraged by the court's intervention on the "actual location" provision and said VPNs should be recognized as a critical security tool. The spokesman added that while Utah's child-protection intent may be legitimate, VPNs should not be treated as a scapegoat, and other states should draft targeted child-safety bills without sacrificing privacy and security.

TechRadar reports that Utah's attempt was part of a growing trend of state-level age-verification bills, and that it was the first to explicitly target tools used to preserve online anonymity. The injunction pauses enforcement of the VPN location rule for now, but the wider age-verification law remains contested. Utah's attorney general may appeal, according to the report.

TechRadar also reported that privacy advocates view the ruling as a precedent: states cannot arbitrarily require websites to undermine essential cybersecurity infrastructure. ID Tech Wire, cited by TechRadar, said the decision sends a message to other states considering similar bills that the First Amendment cannot be bypassed by effectively outlawing digital privacy tools.

Interpretation: The ruling is preliminary, not a final judgment on SB 73's constitutionality. It signals judicial skepticism toward laws that require platforms to defeat encryption or VPN masking, but it does not settle how far states can go in age-verification legislation.