Berlin — Age-verification statutes have always had a hole in them. A user in a regulated state connects through a server in another country, the site sees a foreign IP address, and the gate never opens. Lawmakers in Salt Lake City have now tried to legislate that hole shut.
Utah’s Senate Bill 73, the Online Age Verification Amendments, is the first U.S. statute to treat physical presence in the state as the legal fact that matters — even when a visitor uses a virtual private network, a proxy, or any other tool that makes the connection look as if it originated elsewhere. Covered commercial sites must still treat that person as a Utah user. They are also barred from “facilitating or encouraging” VPN use to get around the checks, including by publishing instructions or offering a way to slip past a geo-block.
That is not a consumer VPN ban. A Salt Lake City resident can still encrypt a coffee-shop connection or tunnel into a work network. The target is the adult site, the cam platform, the tube operator, the subscription studio — anyone whose inventory meets Utah’s “substantial portion” test of more than one-third material the state classifies as harmful to minors.
For a European trade readership, the detail that matters is not the slogan. It is the compliance architecture. If this model travels, geoblocking a handful of U.S. states stops being a complete answer.
What the bill actually changed
Governor Spencer Cox signed SB 73 on 19 March 2026 after near-unanimous votes: 22–2 in the Senate, 66–1 in the House. Republican Sen. Calvin R. Musselman carried it; Rep. Steve Eliason took it through the House. Most of the verification and enforcement amendments were timed for 6 May. A separate 2 percent excise tax on defined digital adult transactions is scheduled for 1 October.
The law sits on top of Utah’s 2023 age-verification statute, SB 287 — the measure that already pushed Aylo, parent of Pornhub, YouPorn and RedTube, to geoblock the state rather than collect IDs from Utah traffic. SB 73 does three things that earlier state bills generally left implicit.
First, the “deemed-location” rule. A person actually in Utah is accessing the site from Utah “regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location.” The operator’s logs are no longer the last word. The physical body is.
Second, a speech and product restriction aimed at the operator. A covered commercial entity “may not facilitate or encourage” VPN or proxy use to circumvent verification, including by giving instructions or providing a means for people in the state to beat geofencing or blocking. That is the clause privacy firm Nym flagged as a restriction on speech about a lawful privacy tool — a First Amendment question, the company said, that U.S. courts have not answered. The Electronic Frontier Foundation has made the same point in blunter language: the statute stops platforms from giving “basic, truthful information about a lawful privacy tool.”
Third, the enforcement machine. The Division of Consumer Protection can investigate, audit and fine up to $2,500 per violation. Courts can add civil penalties. Verification vendors are told not to keep identifying information after access is granted — a data-minimization line that sounds protective until an operator is asked, in the next breath, to know who is physically sitting in Provo behind an Amsterdam IP.
Musselman’s public defense has been simple: companies that profit from material harmful to minors should take “reasonable steps” to keep children out. The adult industry’s answer is equally simple, and more technical. Reasonable steps assume a detectable user. A well-configured VPN is designed not to be one.
The liability trap
Free Speech Coalition executive director Alison Boden put the operational problem in one sentence when the May effective date approached: the statute makes compliance “extremely difficult, if not impossible.” IP geolocation was already imperfect. SB 73, she argued, effectively asks platforms to treat every visitor as a potential Utahn and to age-verify the world.
That is the trap NordVPN and other infrastructure vendors have described. There is no complete, current list of VPN exit nodes. Providers add addresses constantly. Aggressive blocklists catch corporate remote-access ranges, university networks and privacy tools used for journalism or banking. Soft blocklists miss residential proxies and freshly spun servers. Either way, the site is guessing — and the statute assigns the cost of a wrong guess to the site.
Veteran adult-industry counsel have been unusually aligned. Lawrence Walters called the expectation that a private company can identify the true location of a VPN user “an impossibility,” and said a state that enforced first and litigated later could face fees of its own. Corey Silverstein framed Aylo’s suit as the next collision after years of age-gating fights: mandatory identity systems versus the right to access lawful speech without handing a government contractor a driver’s license.
The practical menu for an operator is ugly:
- Geoblock Utah IPs and hope a court later accepts that as “reasonable” even though the statute says physical presence, not IP, is the test.
- Try to detect and block known VPN ranges — a moving target that will anger legitimate users and still leak traffic.
- Age-verify every visitor, everywhere, so a Salt Lake City session routed through Frankfurt is still gated. That is the outcome Aylo says turns one state’s rule into a global ID checkpoint.
- Exit the U.S. market slice, or the whole U.S. market, and accept the traffic and payment-processing hit.
None of those options is a product strategy. They are litigation postures.
Aylo sued. Everyone else is watching the calendar.
Aylo Freesites Ltd. and Aylo Group Ltd. filed in the U.S. District Court for the District of Utah on 22 April 2026 (case 2:26-cv-00340), before Judge David Barlow. The complaint treats the deemed-location rule as extraterritorial legislation: Utah, the company argues, is projecting its policy onto transactions that look, from the server’s point of view, like they happened in another state or another country. Counsel also invoke the dormant Commerce Clause and the Foreign Commerce Clause — the claim that one state cannot set the operating terms of a global internet service.
What followed was not a clean injunction covering the whole market. It was a private ceasefire. Utah agreed not to enforce the challenged VPN-related provisions against Aylo for a defined period, provided Aylo keeps its existing Utah geofence in place. That pause was first set through 3 September, then extended by joint stipulation in late August. The current deal runs until 22 October — two weeks after a proposed administrative rule’s effective date — or until Barlow rules on the preliminary-injunction motion, whichever comes first. A July 30 hearing came and went without a decision.
The Division of Consumer Protection has been explicit about the scope. The forbearance “is strictly limited to Aylo.” Nothing in the stipulation stops the state from moving against other non-compliant operators. Industry lawyers counter that a regulator would be reckless to fine a mid-size studio for a technical standard a federal judge has not yet blessed. That is a bet, not a safe harbor.
For everyone who is not Aylo — EU tube mirrors, creator platforms with a U.S. audience, payment facilitators, age-assurance vendors writing Utah into a rules engine — the statute is live. The pause is a courtesy extended to the plaintiff with the largest litigation budget.
The speech clause is the sleeper issue
Trade coverage has focused on detection. The clause that may travel fastest into copycat bills is the ban on telling users how a VPN works in this context.
Covered sites may not provide “instructions on how to use a virtual private network or proxy server to access the website” or “means for individuals in this state to circumvent geofencing or blocking.” Help-center copy, social posts, even a blunt “we don’t operate in Utah — some users use privacy tools” note now sits closer to regulated speech than customer service. Nym’s critique is that the state is not merely demanding age gates. It is policing talk about a tool that remains legal for the user.
That matters in Europe as much as in Utah. If U.S. counsel start treating VPN explainers as prohibited encouragement, compliance teams in Berlin, Amsterdam and Prague will be asked to scrub the same language from global sites — because one CMS serves every market.
Utah is late to age-gating and early to the workaround war
The United Kingdom already ran the natural experiment. After the Online Safety Act’s highly effective age checks landed on 25 July 2025, VPN demand jumped and then stayed elevated. Ofcom later estimated daily UK VPN users at about 2.2 million, against 1.2 million before the rules. Adult-site traffic among the top services fell and did not fully recover. The British government, after consulting on whether to age-gate VPNs themselves, said in July 2026 that it would not ban or age-restrict the technology, citing legitimate privacy and security uses — while still pushing platforms to get better at spotting underage circumvention.
Utah went the other direction. It did not wait for a federal regulator to study VPN behavior. It wrote physical presence into the statute and told the website to solve a problem the UK’s own government has so far declined to solve by prohibition.
Brazil is the other data point operators already live with. The Digital ECA (Law 15.211) took force in 2026, self-declaration is out, and the national data-protection authority ANPD has begun monitoring 18 adult and escort sites that account for roughly 98 percent of relevant Brazilian traffic. Local workarounds followed the same pattern seen in Britain: users look for a foreign exit node rather than hand over a national ID number. Brasília has not copied Utah’s deemed-location language — yet. The political incentive is obvious once a regulator publishes traffic numbers and then watches them leak out through tunnels.
Inside the United States, copy-and-paste is already underway in spirit. Ohio’s proposed “Innocence Act” would push adult sites toward licensed, continuously monitored geofencing — a different technical fantasy with the same goal: stop treating the IP address as destiny. More than two dozen states already have age-verification laws in force or in motion. The first state to name the VPN in statute will not be the last.
What this means on a European shop floor
Venus-circuit companies do not need a Utah lawyer on retainer to feel this. They need a policy for three overlapping risks.
Product and UX. Global age-assurance vendors will sell “VPN-aware” location as a feature. Buyers should ask what that feature actually is. Most offerings still combine IP reputation, device signals and a risk score. None of that is a GPS lock on a body in Utah County. If a vendor claims otherwise, get it in writing and assume a court will not be impressed.
Content and comms. Help pages that mention privacy tools, “how to access from your country” guides, and affiliate blogs that walk through location masking are now a documented risk for any property that can be reached from Utah and meets the one-third test. The statute is aimed at covered adult sites, not at every VPN review in existence — but marketing teams have a habit of republishing the same FAQ everywhere.
Tax and payments. The 2 percent levy from 1 October is a second compliance workstream. Age-gating fights usually arrive first as traffic and conversion problems. Utah is pairing the gate with a fiscal claim on the same transactions. Payment facilitators and EU studios selling into the U.S. should not treat the tax as a local sales-tax footnote. It is part of the same bill that redefined who a “Utah user” is.
Litigation posture. Aylo’s Commerce Clause theory is the industry’s best current shield, and it is not a shield for anyone else until a judge says so. Mid-size operators who neither geoblock nor verify, on the assumption that Utah will only chase Pornhub, are reading the Division’s own statements incorrectly.
The precedent, not the fine print
SB 73 will be remembered less for its $2,500 tickets than for a drafting choice. Earlier U.S. bills told sites to check the age of people they could identify as in-state. Utah told sites they are responsible for people they cannot identify.
If Barlow eventually blocks the deemed-location clause, other legislatures will still have the template. If he does not, the rational business response — the one NordVPN warned about — is to stop trying to tell Utah traffic from German traffic and to put an age gate on the front door of the entire internet property.
That is how a statute written for one conservative U.S. state becomes an operational standard in Hamburg and Barcelona. The children-protection pitch writes itself. The engineering does not. And the companies being asked to invent a detector for a tool built to defeat detection are the same companies that already left Utah once rather than collect papers at the door.
The next six weeks are about a federal judge, an administrative rule and a tax date. The next two years are about how many other capitals decide that if the VPN is the loophole, the website is the one who has to close it.