By Rindala Alajaji<\/p>\n\n\n\n When state lawmakers attempt to rewrite how the internet works, users rely on courts to recognize that laws can\u2019t make technical impossibilities a reality. That\u2019s why we were happy to see that a court has blocked Utah\u2019s attempt to outlaw the privacy protections of Virtual Private Networks (VPNs). <\/p>\n\n\n\n In a win for digital rights, a federal judge has issued a preliminary injunction<\/a> blocking Utah\u2019s SB 73, the state\u2019s draconian anti-VPN age verification law<\/a>. The decision comes as EFF submitted our comments<\/a> to the Utah Department of Commerce, detailing how forcing platforms to detect and block privacy-preserving tools undermines user privacy and security worldwide while demanding the impossible. <\/p>\n\n\n\n Signed into law earlier this year<\/a>, SB 73 attempted to regulate adult websites by requiring them to block VPN users or to identify the physical location of visitors using them or similar tools that mask their network traffic. It even went so far as to prohibit websites from offering instructions on how to use a VPN to bypass these checks. This made Utah, to EFF\u2019s knowledge, the first state in the nation to target the use of VPNs to avoid legally mandated age-verification gates. <\/p>\n\n\n\n The Utah federal court halted enforcement<\/a> of the law’s VPN provisions last week, r<\/a>uling that the law likely violates the U.S. Constitution\u2019s prohibition on passing laws that significantly burden businesses and people outside Utah\u2019s borders. <\/p>\n\n\n\n SB 73 burdens the rights of all internet users outside of Utah because it requires adult websites to either know every visiting user\u2019s physical location, and then block those in Utah, or to verify every visitor\u2019s age just in case they might be in Utah. The law\u2019s \u201cactual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating,\u201d the court wrote. The court essentially ruled that Utah has less-burdensome ways to prevent Utah minors from accessing adult websites than requiring all users in the world to comply with SB 73. <\/p>\n\n\n\n Aylo\u2019s lawsuit does not challenge SB 73\u2019s provision prohibiting the websites covered by the law from sharing information about VPNs. <\/p>\n\n\n\n This court order follows months of legal maneuvering. <\/p>\n\n\n\n Initially set to go into effect in May 2026<\/a>, SB 73 sparked an immediate constitutional challenge from Aylo<\/a>, the parent company of major online adult platforms like Pornhub. In response to the lawsuit, Utah and Aylo initially agreed<\/a> that the state would pause enforcement while the court considered the preliminary injunction request or<\/em> until administrative rules setting specific compliance terms were finalized. Those proposed compliance rules (R152-78B, see Utah State Bulletin, page 6<\/a>) were published by the Utah Department of Commerce\u2019s Division of Consumer Protection on September 1st, and EFF submitted formal comments<\/a> to the Department in opposition. According to the notice, the proposed rules could be effective as soon as October 8, 2026. However, Judge Barlow\u2019s decision means that it cannot be enforced pending further action by the court. <\/p>\n\n\n\n EFF welcomes Judge Barlow\u2019s ruling, which recognizes the fundamental disconnect between state legislation of the internet and how technology works. In his ruling, Judge Barlow noted that the statute requires a technical impossibility on pain of legal liability. \u201cAylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites\u2019 users.\u201d <\/p>\n\n\n\n The court recognized that the problem is that SB 73 \u201crequires entities like Aylo to geolocate its website users with perfection to avoid liability.\u201d But, at the same time, the court acknowledged \u201cthat geolocation perfection is not presently possible.\u201d <\/p>\n\n\n\n EFF explained this technical impossibility in our comment to the Department of Commerce.<\/a> VPNs protect user privacy by routing web traffic through intermediary servers. Because destination websites only see the IP address of the VPN server, they have no reliable mechanism to tell whether a connection originates from Salt Lake City, Seattle, or Shanghai. So, under Utah’s current statutory framework, platforms are left with an impossible choice: completely block all VPN traffic nationwide or withdraw access from Utah entirely. Judge Barlow agreed, asserting: <\/p>\n\n\n\n Because the law requires perfection in the absence of perfect geolocation tools, Aylo would need to verify those 28 million users\u2014whether located in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu\u2014to ensure compliance and avoid liability.<\/p>\n<\/blockquote>\n\n\n\n The administrative rules drafted by the state compelled commercial entities to implement “commercially reasonable geolocation obfuscation detection systems”, which is a directive, we argue, that demands a technical impossibility. <\/p>\n\n\n\n In our submission to the Utah Department of Commerce, EFF also detailed how these rules force an invasive data collection regime onto internet users everywhere. So, in response to internet users trying to avoid invasive data collection required by age-verification requirements, SB 73 requires even greater surveillance of internet users\u2019 online activities. The Department\u2019s suggested detection heuristics (like monitoring connection latency or device time zones) are notoriously unreliable and easily skewed by normal network conditions. This active surveillance inevitably leads to widespread misclassification, unwarranted access blocks, and severe impacts on users\u2019 privacy far beyond Utah’s borders. <\/p>\n\n\n\n You can read EFF\u2019s full comments to the Department of Commerce here<\/a>. <\/p>\n\n\n\n Mandating invasive tracking and punishing the use of essential security tools turns genuine privacy concerns into mere compliance theater and requires more state-mandated surveillance of internet users who rely on VPNs. As is the case in heavily censored regions, VPN services and obfuscation tools will simply adapt, making this framework fundamentally unsustainable. <\/p>\n\n\n\n As we\u2019ve said time<\/a> and time again<\/a>: the internet will always route around censorship. <\/p>\n\n\n\n![\"Highway](\"https:\/\/www.eff.org\/files\/banner_library\/vpn-highway-tunnel-banner.jpg\")
What SB 73 Does<\/strong> <\/h2>\n\n\n\n
The Legal Challenge<\/strong> <\/h2>\n\n\n\n
The Ruling<\/strong> <\/h2>\n\n\n\n
\n
The Rulemaking<\/strong> <\/h2>\n\n\n\n