Utah Pauses Enforcement of SB 73 VPN Rules After Aylo Lawsuit
The disputed VPN provisions are temporarily on hold until 3rd September 2026. The law has not been repealed, and the court has not yet ruled that it is unconstitutional.
Utah's newest VPN-related age-verification rule is not currently being enforced against Aylo while its federal challenge is considered. That is a procedural pause, not a repeal of Senate Bill 73 and not a ruling that every Utah age-verification requirement is suspended. The distinction matters because much of the wider law took effect on 6th May 2026.
Current Status: Paused, Not Cancelled
Aylo Freesites Ltd. and Aylo Group Ltd. filed a federal lawsuit on 22nd April 2026 against the Utah Division of Consumer Protection and state officials. Aylo also requested a preliminary injunction to prevent enforcement while the court considers the constitutional issues.
Utah subsequently agreed not to enforce the disputed VPN-related rule until 3rd September 2026. The agreement gives the parties and the court time to address the preliminary-injunction motion without immediate enforcement pressure.
The VPN rule is temporarily dormant. It remains written into Utah law and could become enforceable later unless the court blocks it, the parties extend the pause, or lawmakers change the statute.
What Was Actually Paused?
The dispute centres on Section 14 of SB 73, which amended Utah Code Section 78B-3-1002. The most contested language treats a person as accessing a website from Utah when the person is physically in the state, even when a VPN, proxy or another method makes the connection appear to originate elsewhere.
That rule is important because covered adult-content websites can face liability for failing to perform age verification. Aylo argues that a website cannot reliably identify every Utah visitor once location-masking technology is involved, so the provision may force worldwide age or location checks to avoid Utah liability.
Reporting often calls this a pause of “Utah's VPN law”. A more precise description is that Utah agreed to hold off enforcement of the challenged VPN-location provision during the preliminary stage of the case. It is not a statewide suspension of all age-verification law.
For the original statutory background and the difference between a VPN restriction and a blanket VPN ban, see our earlier Utah VPN age-check guide.
What Remains in Force?
SB 73 is broader than its VPN language. Most of the bill's age-verification and enforcement amendments were scheduled to take effect on 6th May 2026. The temporary agreement should not be read as switching off every part of the statute.
| Part of SB 73 | Current Reading | Why the Distinction Matters |
|---|---|---|
| VPN-based deemed-location rule | Enforcement temporarily paused | This is the centre of Aylo's present challenge and the immediate non-enforcement agreement. |
| General age-verification duty for covered sites | Not automatically suspended | Utah's existing and amended age-verification framework is wider than the VPN-location language. |
| Ban on facilitating age-gate circumvention | Legally connected; scope should be checked | Section 14 also restricts covered sites from encouraging VPN or proxy use to bypass verification. The precise reach of any non-enforcement commitment should be read against the court filings. |
| 2% covered-entity excise tax | Scheduled separately for 1st October 2026 | The tax provisions have a later statutory effective date and are not the same issue as the immediate VPN dispute. |
| Final constitutionality of SB 73 | Not decided | The temporary pause does not establish that Aylo will win or that Utah's law will survive. |
Businesses should not assume that every compliance obligation disappeared on the date of the pause. The court docket, the parties' stipulation and any later Utah guidance should be reviewed before changing an age-verification programme.
What Aylo Is Arguing
Aylo's complaint asks the federal court for declaratory and injunctive relief. Its core position is that Utah cannot turn a state age-verification rule into a practical global obligation merely because a Utah visitor might conceal their location.
According to the complaint and reporting on the case, Aylo says the deemed-location rule creates an impossible compliance choice: verify the age or location of users far outside Utah, or risk penalties when an undetected Utah visitor connects through a VPN. Aylo frames that as an unconstitutional burden on interstate and foreign commerce.
These are Aylo's legal allegations. The court has not yet accepted them as proven facts or issued a final ruling on the merits.
Who is named in the case?
- Plaintiffs: Aylo Freesites Ltd. and Aylo Group Ltd.
- Defendants: the Utah Division of Consumer Protection, its director Katie Hass, the Utah Department of Commerce and Executive Director Margaret Busse.
- Court: U.S. District Court for the District of Utah.
- Case number: 2:26-cv-00340.
Why VPN Detection Is the Technical Fault Line
Websites can identify some VPN traffic by comparing visitor IP addresses with commercial proxy databases, data-centre ranges and prior abuse signals. Those methods can catch many conventional VPN servers, but they do not reveal a person's physical location with certainty.
The hard cases include newly assigned server addresses, private tunnels, mobile networks and residential proxies. A connection routed through an ordinary household IP address may be difficult to distinguish from genuine local broadband. False positives also matter: a broad block can deny access to lawful users who rely on a VPN for work, security or personal privacy.
| Detection Signal | What It Can Show | What It Cannot Prove |
|---|---|---|
| Known VPN IP list | That an address has previously been associated with a VPN or hosting provider. | The visitor's true state, age or current physical location. |
| Browser time zone or language | That device settings may not match the apparent IP region. | That the mismatch is deliberate or that the person is in Utah. |
| Account and payment history | That a user previously supplied information linked to a region. | Where the user is at the moment of access. |
| Residential proxy signal | Sometimes, that traffic patterns are unusual or shared. | A reliable distinction between a proxy and an ordinary home connection. |
What the Pause Means for VPN Users
Ordinary VPN use has not been made illegal in Utah. The law regulates covered websites and their age-verification responsibilities rather than creating a general offence for subscribing to or connecting through a VPN.
The pause also does not guarantee access to any particular website. Platforms can maintain their own geoblocks, reject known VPN addresses or ask for age verification under their terms and compliance policies. Aylo has previously blocked its sites in Utah, so a state enforcement pause does not necessarily change a platform's access decision.
- A VPN still does not change a person's physical location for legal purposes.
- Websites may continue to use VPN-detection services voluntarily.
- A temporary non-enforcement agreement does not create a permanent privacy right or access entitlement.
- Users should distinguish between lawful privacy use and attempts to evade a legally required age gate.
What the Pause Means for Websites
For covered publishers, the pause reduces the immediate risk of Utah enforcing the disputed VPN-location rule before the agreed date. It does not remove the need to monitor the case or comply with other applicable parts of Utah law.
- Keep the legal scope narrow: document which provision is paused rather than treating the entire statute as inactive.
- Preserve compliance records: retain evidence of age-verification controls, vendor decisions and privacy safeguards.
- Avoid overclaiming VPN detection: technical risk scoring is not the same as certain physical-location identification.
- Track the docket: a preliminary-injunction order, extension or revised agreement could change the position before September.
- Review data handling: SB 73 states that identifying information used for age verification must not be retained after access is granted.
This article explains the public status of the dispute. It is not a substitute for advice from counsel familiar with Utah law, the site's content mix and its age-assurance systems.
Timeline of the Utah VPN Dispute
Governor Spencer Cox signed SB 73, the Online Age Verification Amendments.
Aylo Freesites Ltd. and Aylo Group Ltd. filed their complaint and motion for a preliminary injunction in federal court.
Most non-tax provisions of SB 73 were scheduled to take effect.
Utah agreed not to enforce the challenged VPN-related rule before 3rd September 2026 while the court considers the case.
Current end date of the non-enforcement period, unless the parties or court change the schedule.
SB 73's separate covered-entity excise-tax provisions are scheduled to take effect.
Frequently Asked Questions
Has Utah repealed SB 73?
No. SB 73 remains on the statute book. Utah agreed to a temporary period of non-enforcement for the disputed VPN-related rule while Aylo's federal challenge proceeds.
Did a judge declare the VPN provision unconstitutional?
No. The pause is not a final merits judgment. Aylo has asked for declaratory and injunctive relief, but the constitutional questions remain unresolved.
Is every Utah age check paused?
No. The agreement concerns the challenged VPN-related part of the law. It should not be described as a blanket suspension of Utah's entire adult-content age-verification framework.
Can Utah residents legally use a VPN?
Yes, ordinary VPN use is not generally prohibited by SB 73. The law focuses on covered websites, location masking in the age-verification context and assistance with circumventing age gates.
Will the rule automatically start on 3rd September?
Not necessarily. The parties could extend their agreement, the court could issue an order, or the case schedule could change. The docket and official state guidance should be checked near the date.
Why is Aylo challenging the law if its sites already block Utah?
Aylo argues that blocking visible Utah IP addresses does not solve the deemed-location problem because a person physically in Utah may appear to connect from another state or country through a VPN. Its complaint says this exposes the company to liability despite its Utah geoblock.
Written by Martin Needs
“The pause resolves the immediate enforcement deadline, not the underlying technical problem. A risk score can flag likely VPN traffic, but it cannot prove every visitor's physical location.”
Primary and Reporting Sources
- Utah Legislature — Enrolled Copy of S.B. 73, Online Age Verification Amendments.
- Justia Docket — Aylo Freesites Ltd. et al. v. Utah Division of Consumer Protection et al..
- Electronic Frontier Foundation — Utah's VPN provisions and May 2026 non-enforcement update.
- The Salt Lake Tribune — Utah VPN enforcement placed on hold during litigation.
- KSL / Deseret News — Aylo's constitutional challenge and Utah's response.