Utah’s VPN Law Hits a Wall: Why a Federal Judge Called Location-Guessing Impossible

For roughly six months, Utah’s SB 73 hung over the VPN industry like a weather front nobody could outrun. It was the first law in the United States to treat a VPN not as a privacy tool but as a loophole, and it handed website owners the bill whenever someone slipped through. On September 24, a federal judge pressed pause on the part that mattered most. A month later, the aftershocks are still reshaping how lawmakers, adult websites and VPN companies think about the next round of age-verification bills.

This briefing walks through what the law tried to do, why the court found its central requirement unworkable, what remains in force, and what all of it means if you simply use a VPN to protect your connection on café Wi-Fi. No law degree required. We will keep the jargon on a short leash and explain every term the first time it appears.

01  What Utah actually tried to do

SB 73, formally titled the Online Age Verification Amendments, cleared the Utah legislature on March 4 and was signed by Governor Spencer Cox on March 19. It did not appear out of thin air. Utah already required adult websites to verify that visitors are adults, and that earlier law had a glaring weakness that every lawmaker could see: a VPN lets a person in Salt Lake City look like a person in Frankfurt. If the website thinks you are in Germany, Utah’s age rules never trigger.

SB 73 attacked that gap head-on. Its key provision said a person is considered to be accessing a site from Utah if they are physically located in the state, regardless of whether they are using a VPN or a proxy to mask their location. In other words, the legal question stopped being “where does the website think you are?” and became “where are you really?” The law also barred covered websites from publishing instructions on how to use a VPN to get around age checks. Outlets that read the enrolled bill reported penalties of up to $2,500 per violation, rising to $5,000 for defying an order, and the measure also created a 2% tax on adult-content revenue that begins this month.

Here is why that matters for the law. Picture a nightclub bouncer told to check the ID of anyone who is physically in the city. That sounds simple until some guests arrive through an underground tunnel and the bouncer can only see where the tunnel exits. SB 73 told the bouncer to be right anyway, and made the club liable every time the bouncer guessed wrong. That is what lawyers call strict liability, and it is the heart of why this law drew such a strong reaction.

02  The ruling: why “where are you really?” has no reliable answer

The challenge came from Aylo, the company behind Pornhub, which sued in May. Rather than defend the law while the case played out, Utah agreed to hold off on enforcement. Then, on September 24, Judge Barlow granted the preliminary injunction. Reporting on the order says he agreed it would be nearly impossible for a company to comply, because the law effectively required a site to geolocate every visitor with an accuracy that current technology simply cannot deliver. Coverage also notes the judge flagged vagueness in how the geolocation duty was described.

A preliminary injunction is a court’s way of saying, “Hold everything while we sort this out.” Judges generally grant one when the challenger looks likely to win on the merits and would suffer real harm in the meantime. It is not the last word. Utah can still defend the law, rewrite it, or appeal, and the provision stays on ice until a judge decides its constitutionality.

So why is geolocation through a VPN such a shaky foundation? Because the address a website sees is a label, not a GPS coordinate. Services that map addresses to places rely on databases that are educated guesses. Mobile carriers frequently route traffic through hubs hundreds of miles from the phone. VPN servers can be rented in one country and advertised in another. Websites cannot simply ask your phone for its GPS position without a permission prompt, and a VPN user is precisely the person who would decline. Trying to determine a hidden person’s true location from the outside resembles trying to guarantee rain over one specific house using a regional weather forecast. You can improve the odds, but a promise of certainty is a promise nobody can keep.

The law asked websites to be certain about something the internet was never built to reveal.

— Coedee Team

There is a second layer to the story. In early September, Utah published proposed rules on VPN detection, with October 8 listed as the earliest date they could take effect. The Electronic Frontier Foundation warned that such detection rules could encourage even more tracking while mislabeling ordinary, law-abiding users. That is a recurring pattern in age-verification fights: a rule meant to protect children ends up demanding more surveillance of adults, because the only way to be “sure” is to collect more data.

03  What survived, and why the picture looks messy

Headlines about the ruling sometimes made it sound as if Utah’s entire age-verification regime collapsed. It did not. Analysts who read the order closely stress that the injunction targets the specific clause that treats a person as being in Utah even when a VPN says otherwise. Core age-check obligations for adult websites remain intact. After the ruling, Utah’s Department of Commerce began pursuing enforcement on the unaffected provisions, and the Free Speech Coalition told its member sites to comply with whatever the judge left standing, noting that most had already been doing some form of age verification since 2023.

The state senator working on a revision told local media he is open to input as he drafts a fix for the judge’s concerns, while conceding it may be difficult to block VPN use at all. That candor is revealing. Even supporters of the policy admit the technical wall is real.

Another source of confusion is the calendar. Different outlets reported different effective dates, with some citing May 6 and others pointing to September 3 with enforcement paused. Those accounts differ because the rollout itself kept shifting: the law was signed, scheduled, paused, challenged, partly frozen and partly enforced within a single year. If you are tracking this as a compliance matter, rely on the court order and state notices rather than any single news summary.

One more detail matters for everyday users. Before SB 73 existed, Pornhub and other adult sites had already begun refusing every Utah IP address in protest of the state’s earlier age-check law, and those blocks reportedly remain in place. Whenever a site flips the “block everyone from this region” switch, VPN subscribers in the area get swept up too. That is not a VPN malfunction. It is a publisher’s decision about legal risk.

04  The ripple effect: Wisconsin, a patchwork of states, and the VPN industry’s response

Utah is not alone, but it is the outlier that went furthest. Wisconsin considered nearly identical VPN provisions in Senate Bill 130, then removed them in February after heavy lobbying from digital rights groups, VPN providers and the tech industry. Legislators there recognized a constitutional problem before it reached a courtroom. Utah plowed ahead, which is how it became the test case.

VPN companies were blunt from the start. NordVPN described the structure as a liability trap that punishes privacy-minded users across the globe. AdGuard VPN said it did not read SB 73 as creating direct duties for VPN providers, and that it would not change how its service works for Utah customers. Other leading providers made similar statements, calling the law a dangerous precedent that fails to solve the problem it targets. Meanwhile, the EFF’s warning has aged well: faced with unlimited liability, a cautious website has two blunt options. It can block every known VPN address, or demand age verification from every visitor worldwide. Both outcomes spill far beyond Utah’s borders.

The international record points the same way. After the UK began enforcing age checks under its Online Safety Act, VPN use reportedly jumped by more than 1,400% on the first day, and Ofcom has said it is monitoring VPN use. Surges like that show how quickly people reach for privacy tools when a new gate appears, and they hand lawmakers a tempting target. Our read: expect the next wave of bills to avoid Utah’s precise wording while chasing the same goal, perhaps by shifting emphasis to device-level or platform-level checks, or by narrowing who can be held liable. That is analysis, not a prediction of any specific bill, but the incentives are easy to see.

05  What this means if you just use a VPN

If your VPN habits revolve around public Wi-Fi safety, avoiding ad tracking or reaching your own subscriptions while traveling, nothing about this ruling changes your daily life. VPNs remain legal across the United States. The legal fight is about who bears responsibility when a minor reaches restricted content, not about whether adults may protect their traffic.