Federal Judge Strikes Down Utah's Controversial Vpn Age Verification Rules

• A federal judge granted a preliminary injunction against Utah's SB 73
• The move blocks the rules that strictly targeted VPN users
• The judge notes flawless geolocation tracking is technically impossible

Using the best VPN to protect your online privacy is not a loophole, and a federal judge has now formally blocked a controversial state law that treated it as one.

On September 24, U.S. District Judge David Barlow granted a preliminary injunction against Utah’s uniquely aggressive age verification law (SB 73).

The legislation targets VPN use by requiring adult platforms to identify and verify the age of users physically located in Utah, even if they were masking their traffic with a virtual private network (VPN) or similar tool. It also banned sites from providing instructions on how to use a VPN to bypass these checks.

However, the courts have firmly stepped in. In a major victory for digital rights and Aylo, the parent company of Pornhub, which originally filed the lawsuit in May, Judge Barlow blocked the law's most draconian VPN provisions. In his memorandum, the judge stated that the state's mandates are "likely to violate the United States Constitution."

The decision highlights a fundamental gap between legislation and internet infrastructure. As reported by KUER, the judge noted that "perfect geolocation" simply does not exist.

By design, a VPN encrypts your web traffic and routes it through a secure remote server, hiding your true IP address from the websites you visit. Demanding that platforms bypass this encryption to find a user's physical location is not just technically impossible for the websites to guarantee; it also raises severe privacy and free speech concerns.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

???? Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Utah VPN law: What happens next?

Utah’s attempt to regulate VPNs is part of a growing trend of state-level age verification bills, but it was the first to explicitly target the tools used to preserve online anonymity.

Lawmakers in Utah argued they were simply trying to close a technological loophole that teenagers use to access restricted content. But cybersecurity experts and digital rights advocates quickly sounded the alarm. They argued that forcing platforms to effectively break or ban encrypted traffic threatens the safety of journalists, activists, and everyday citizens who rely on VPNs to protect their personal data from hackers, stalkers, and corporate tracking.

Gytis Malinauskas, Head of Legal at Surfshark, previously warned TechRadar about this legislation, noting that it treats a core cybersecurity tool as an illegitimate workaround. "VPNs are a standard security tool millions of Americans use every day to protect their data. Blocking them would only erode the privacy of ordinary users," he explained.

A spokesman for Proton told TechRadar that their company is encouraged to see the court intervene to protect VPN users by blocking the "actual location" provision of SB 73 and recognize VPNs as a critical security tool.

"Although the Utah legislature has a good intention to protect children from adult content, VPNs should not be used as a scapegoat. We hope that other states will take notice and draft their child safety bills in a targeted way that does not sacrifice user privacy and security," they added.

While this injunction temporarily pauses the enforcement of the VPN location rule, the legal battle continues in court. The broader age-verification law remains heavily contested, and Utah’s Attorney General may still appeal the decision.

For now, privacy advocates are celebrating a crucial precedent: state governments cannot arbitrarily force websites to break essential cybersecurity infrastructure. According to ID Tech Wire, the ruling sends a strong message to other states drafting similar bills, you cannot bypass the First Amendment by effectively outlawing digital privacy tools.