On September 24, 2026, U.S. District Judge David Barlow issued a preliminary injunction against a provision of Utah Senate Bill 73 that attempted to hold adult websites liable for failing to verify the age of users physically located in Utah, even when those users employed VPNs to disguise their location. The ruling does not address age verification itself. It addresses a statute that decoupled IP address from legal location and held websites strictly liable for a technical determination they cannot reliably perform.
In this article
What the Court Actually Blocked
Utah Code 78B-3-1002 specifies that age verification requirements apply if the user is “actually located” in Utah regardless of whether the individual is using technologies that make it appear the user is accessing the platform from another state or country. The provision states that an individual is considered to be accessing a website from Utah if the individual is actually located in the state, regardless of whether they use a virtual private network, proxy server, or other means to disguise or misrepresent their geographic location.
The injunction blocks enforcement of this actual-location provision, which was challenged by Aylo, the corporate owner of Pornhub, Youporn, and Redtube, in a lawsuit filed in April 2026. Judge Barlow wrote that the actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating.
Every other state with an age-verification statute treats IP address as a proxy for location. Utah decoupled them. The effect was to transform age verification from a geofencing problem into a universal problem with strict liability attached. A website operator would face penalties not for failing to implement age verification where IP geolocation indicated a Utah user, but for failing to detect that a user presenting a non-Utah IP was actually, physically, in Salt Lake City.
The Attorney General’s Argument and the Court’s Response
Utah Attorney General Derek Brown argued that the state is not looking for perfection, but that companies make a “reasonable effort” to determine whether their users are in Utah. In Judge Barlow’s reasoning, the court is required to “analyze the statutory text the Legislature passed into law, not just the Attorney General’s proposed enforcement of it.”
This distinction matters. A prosecutor may promise restraint. A statute does not. The text of SB 73 created a strict-liability standard: websites were liable if a user was actually located in Utah, full stop. In Judge Barlow’s opinion, “the harm of a constitutional violation is greater than Utah’s interest in enforcing a statutory provision that likely is unconstitutional.”
Judge Barlow found that perfect geolocation is not currently possible, which made the statute’s strict-liability standard practically unworkable. The court did not rule that age verification itself is unconstitutional. It ruled that a statute demanding technical precision that does not exist, and attaching liability to that impossibility, crosses the line.
The Pattern This Fits Into
SB 73 was signed into law by Governor Spencer Cox on March 19, 2026, with the VPN provision set to take effect on May 6. Aylo sued on April 22, 2026, and Utah twice agreed not to enforce the law against the company in the meantime. Utah and Aylo agreed that the state would not enforce the new law against the company pending the judge’s ruling or until administrative rules setting specific compliance terms for adult sites are finalized. A proposed Utah rule establishing age-verification standards and VPN regulation remained open for public comment through October 1.
Utah’s VPN provision emerged in an environment where states have watched age-verification laws trigger either geo-blocking by major platforms or widespread VPN adoption by users seeking to route around compliance requirements. Some sites, including PornHub, blocked access for the entire state of Utah rather than comply with earlier age-verification requirements. Shortly after, there was a spike in Utahns Googling how to get a VPN.
Rather than interpret that pattern as evidence that the policy created its own evasion vector, Utah attempted to legislate the evasion vector out of existence. The legislature wrote a statute that made websites liable for users’ physical locations even when network-layer information indicated otherwise. The court ruled that Utah has less-burdensome ways to prevent Utah minors from accessing adult websites than requiring all users in the world to comply with SB 73.
This is not the first time courts have blocked Utah’s efforts in this domain. In September 2024, U.S. District Judge Robert Shelby issued a preliminary injunction against the Utah Minor Protection in Social Media Act, which was set to take effect October 1, finding that NetChoice is “substantially likely to succeed” on its claim that the law is unconstitutional because it violates the First Amendment. The Barlow ruling is narrower and more technical, but it follows a consistent thread: statutes that impose compliance burdens without technical pathways to compliance do not survive judicial scrutiny.
What This Means for Email and Anonymous Communication
The immediate implication is jurisdictional. If a state can hold a service provider liable for the physical location of users whose network traffic indicates they are elsewhere, then every service with end-to-end encryption, every anonymizing proxy, and every VPN becomes a liability surface. The statute does not distinguish between adult content and encrypted email. It establishes a principle: physical location trumps network identity, and the service provider is responsible for knowing the difference.
Email services that route over Tor or offer encrypted communication as a default operate on the assumption that IP addresses are unreliable indicators of identity or location. This is not a bug. It is the design. A jurisdiction that penalizes operators for failing to pierce that design penalizes the architecture itself.
The EFF warned that holding companies liable for verifying the age of users in Utah, including those using VPNs, is technically unrealistic because websites generally cannot reliably determine a VPN user’s actual location. According to the group, that could force websites to either “ban all known VPN IPs, or to mandate age verification for every visitor globally.” Both outcomes erode privacy for users who are not in Utah, have no connection to Utah, and whose use of privacy tools has nothing to do with bypassing age gates.
When compliance is impossible, the rational response is withdrawal. Platforms geo-block. Services refuse connections from known VPN ranges. The user response is predictable: more sophisticated evasion. Even trying to block all VPNs and proxies would be difficult; the EFF describes it as “technical whack-a-mole.”
Designing for Legal Uncertainty
The Barlow injunction is preliminary. Utah’s law will remain enjoined until a judge rules on its constitutionality. If the provision is ultimately struck down, it sets a precedent that statutes cannot impose strict liability for determinations that are technically infeasible. If Utah prevails on appeal, the precedent is worse: states can hold services liable for the physical location of users regardless of what network data indicates, which transforms every anonymizing service into a per-user compliance risk.
Email providers operating under principles of minimal data retention, end-to-end encryption, and anonymity over Tor do not collect the data required to comply with an actual-location standard. Collecting that data would require defeating the encryption, logging metadata, or demanding identity documents tied to physical addresses. Each option undermines the architecture that makes private communication possible.
Services designed around these principles route over Tor precisely because IP addresses are not reliable indicators of user intent, identity, or jurisdiction. Some accept cryptocurrency payments to avoid tying accounts to financial identity. The design assumes that physical location is not the service’s concern, and that users have legitimate reasons to separate their network presence from their geographic one. Open-source post-quantum cryptography platforms operating under AGPL-3.0 work on the assumption that cryptographic protections should not depend on servers knowing where users are physically standing.
These design choices are not neutral. They are responses to a threat model in which states assert jurisdiction based on user location, demand data service providers do not possess, and penalize operators for failing to collect it. The Utah statute, even in its blocked form, clarifies that threat model. It tells operators: the fact that compliance is technically infeasible is not a defense. The fact that compliance would require re-architecting the service is not a defense. The statute demands compliance, and the penalties apply whether or not the technical means exist.
The Trajectory
Judge Barlow ruled that a statute demanding technical impossibility cannot stand, at least not without meeting an extraordinarily high bar of constitutional scrutiny. That is a procedural win. It does not resolve the deeper tension: states believe they have the authority to regulate conduct within their borders, and they are writing statutes that treat network-layer obfuscation as an obstacle to be legislated away rather than a feature of how global communication infrastructure works.
The pattern is not unique to Utah. Age-verification laws are proliferating. Some will be blocked. Some will be enforced. The ones that survive will be the ones that impose compliance burdens service providers can technically meet without breaking their own architecture. The ones that fail will be the ones that, like SB 73’s actual-location provision, demand precision that does not exist and attach strict liability to the gap between what the law requires and what technology can deliver.
Operators building for privacy are building for a regulatory environment in which courts will occasionally recognize technical impossibility as a defense, but legislatures will continue writing statutes that ignore it. The injunction is not a resolution. It is a delay.