In brief: A federal judge has paused Aylo’s lawsuit over the VPN provision in Utah’s age-verification law, SB 73, until the end of the state’s 2027 legislative session, after Aylo and Utah jointly asked to wait for possible amendments, XBIZ and AVN reported Oct. 13.
Most lawsuits end with a winner and a loser. In this one, both sides have agreed to wait and see what Utah’s lawmakers do.
Pornhub parent company Aylo and the state of Utah asked the U.S. District Court for the District of Utah to stay the case, XBIZ reported Oct. 13. Judge David Barlow granted the motion, pausing proceedings until the end of the Utah Legislature’s next general session, which is scheduled to run from Jan. 19 to March 5, 2027.
Rather than continuing to litigate Plaintiffs’ claims against the current version of S.B. 73, the parties therefore agree that staying further proceedings in this case would be the most efficient course for both the parties and the Court to see what, if any, amendments the Legislature makes to the provision of S.B. 73 challenged in this case
That’s from the joint filing, as quoted by XBIZ.
Aylo Case Against Utah VPN Rule on Hold Pending Legislative Changes xbiz.com
The provision at issue
SB 73, signed in March, includes a “deemed-location” rule. Under it, a person counts as accessing a site from Utah if they are “actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location.”
So a site can be liable for a Utah user whose VPN reports a different location. The VPN is built to hide that location in the first place.
How it got here
Aylo sued in April. The VPN provision was due to take effect in May, but enforcement was suspended under a forbearance agreement with Utah’s Division of Consumer Protection, which was later extended, XBIZ reported. On Sept. 24, Barlow granted a preliminary injunction, finding the provision likely violates the dormant Commerce Clause. AVN quoted his reasoning:
Aylo argues that because it is impossible to always determine where a user is actually located, Utah’s actual-location provision will require it to age-verify all users, wherever they might actually be located, or face liability. As a result, the actual-location provision operates as an impermissible direct regulation of wholly out-of-state conduct.
That injunction covered only the VPN provision. It did not stop Utah from enforcing the rest of its age-verification law, according to XBIZ.
What the lawyers say
Industry attorney Lawrence Walters told AVN the stay is “sensible” and that “Perfect geolocation does not exist.” He said he hopes Utah lawmakers “use this pause to repeal the law.” Attorney Corey Silverstein put it this way:
A website operator should not face liability simply because a user conceals their location through a VPN
Utah isn’t the only state targeting VPN users. Indiana is suing Aylo, alleging it violated that state’s age-verification law by failing to stop users who get around geolocation, and earlier this month Aylo cited the Utah injunction in a brief asking Indiana’s Marion Superior Court to dismiss that case, XBIZ reported. Age-verification laws themselves were upheld by the U.S. Supreme Court in Free Speech Coalition v. Paxton (June 27, 2025); the Utah case is about the VPN provision, not age checks in general. Overseas, Aylo is dealing with a German network-ban case and Australia’s device-based age checks.
Neither report says the September injunction has been lifted. For now the case is on hold, and the next step is up to the Utah Legislature, which convenes in January.