Federal Judge Preliminarily Blocks Utah Rule Requiring Sites to Identify Users’ True Location

A federal judge has preliminarily blocked part of Utah’s adult-site law that sought to hold websites liable based on where a user is physically located, even if that user masks their location with a VPN or similar tool. In a Sept. 24 order, U.S. District Judge David Barlow of the U.S. District Court for the District of Utah found the provision likely requires a level of geolocation accuracy that current technology cannot achieve and likely violates the dormant Commerce Clause, a constitutional doctrine that limits states from unduly burdening interstate commerce.

The blocked section, Utah Code § 78B-3-1002(3), said a person is considered to be accessing a site from Utah if the person is actually in Utah, even when using “a VPN, proxy server, or other means” to disguise location. In practice, that meant websites could face liability unless they could determine a user’s true physical location or verify ages much more broadly to avoid missing Utah users whose locations were obscured.

The ruling is narrow. Barlow’s preliminary injunction blocks enforcement only of the law’s “actual-location” provision. It does not stop Utah’s broader age-verification requirement in § 78B-3-1002(1)(a), which remains in effect. The judge noted that Aylo Freesites Ltd. and Aylo Group Ltd. — the parent company of adult sites including Pornhub, RedTube and YouPorn — did not bring a facial challenge to that core requirement.

Aylo sued Utah on April 22, 2026. In the Sept. 24 order, Barlow wrote: “Aylo is correct that the statute, as amended, now essentially imposes strict liability for entities like it when it comes to determining the location of its websites’ users.” He also pointed to the scale of the burden described in the record. Aylo said its free sites draw more than 200 million monthly active visitors globally and about 28 million monthly active visitors from the United States.

That mattered to the court’s dormant Commerce Clause analysis because the law’s reach would not stop at Utah’s borders. As Barlow wrote, “Because the law requires perfection in the absence of perfect geolocation tools, Aylo would need to verify those 28 million users—whether located in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu—to ensure compliance and avoid liability.”

The injunction arrives as Utah was moving to implement the law through new regulations. The state Department of Commerce published proposed rules, known as R152-78B, in the Sept. 1 Utah State Bulletin. The draft rules said a “commercially reasonable” age-verification method and a geolocation-obfuscation detection system should each identify users with at least 95% accuracy. The notice said the rules could become effective as soon as Oct. 8.

Utah had already agreed not to enforce the challenged provision against Aylo while the injunction request was pending. The parties filed a joint stipulation for non-enforcement on April 27. With the preliminary injunction now in place, the blocked subsection cannot be enforced pending further court action.

The dispute stems from S.B. 73, a Utah law signed earlier this year that took effect May 6 for most non-tax provisions. It expanded the state’s age-verification regime for adult websites and added the VPN-related actual-location language now on hold. The case lands in a broader wave of state age-verification measures after the U.S. Supreme Court’s 2025 decision in Free Speech Coalition v. Paxton upheld a Texas law. But the Utah case centers on a distinct question: whether a state may require websites to determine users’ actual location even when users try to conceal it. The litigation is ongoing, and the Sept. 24 order is a preliminary injunction, not a final ruling on the merits.