A federal court has halted Utah SB 73's VPN provisions after the Electronic Frontier Foundation (EFF) argued the statute demands a technical impossibility. Signed earlier in 2026 and originally set to take effect in May, SB 73 required websites covering adult content to block users accessing via VPNs or to identify every visitor's physical location — and prohibited those sites from sharing instructions on circumventing the checks.
This illustrates the access-denied consequence of SB 73's mandate that adult sites identify every visitor's physical location or block VPN users entirely.
The core problem, as Judge Barlow recognized, is geolocation. VPNs route traffic through intermediary servers, so destination websites see only the VPN server's IP address — not whether the user is in Salt Lake City, Boston, or Honolulu. SB 73's "actual-location provision" therefore required platforms to geolocate every visitor with perfection to avoid liability. As the court wrote, "geolocation perfection is not presently possible." The result: platforms would need to verify all 28 million users nationwide, or block all VPN traffic entirely, or withdraw Utah access.
The core technical problem identified by the court is that geolocation cannot reliably distinguish a Utah user from one connected behind a VPN.
The court ruled the law likely violates the U.S. Constitution by significantly burdening businesses and people outside Utah's borders, concluding Utah has less-burdensome ways to protect minors. The decision follows EFF's formal comments to the Utah Department of Commerce opposing proposed compliance rules (R152-78B), which had compelled "commercially reasonable geolocation obfuscation detection systems." EFF argued those rules — relying on heuristics like connection-latency monitoring or device time-zone checks — are notoriously unreliable and would force invasive surveillance on users everywhere.
The proposed compliance rules and the court's less-burdensome-alternatives analysis both center on protecting minors from adult-content sites.
What remains uncertain: Utah legislators have indicated they may revise the law in the next session. The proposed compliance rules could become effective as soon as October 8, 2026, but cannot be enforced pending further court action. Notably, Aylo's lawsuit does not challenge SB 73's provision prohibiting websites from sharing VPN information — only the VPN-blocking and geolocation mandates.
The ruling establishes that state lawmakers cannot weaponize age-verification requirements to force dragnet tracking or undermine essential privacy tools. As other states consider similar anti-VPN proposals, EFF has urged regulators to reject technically impossible mandates and prioritize user security.
EFF argued the compliance rules rely on unreliable heuristics that would force invasive surveillance on users everywhere.