Utah has once again positioned itself at the center of the national battle over online age verification and adult-content regulation.
With the enactment of SB 73, formally titled the “Online Age Verification Amendments,” Utah lawmakers significantly expanded the state’s existing regulatory framework governing adult websites. The legislation goes far beyond traditional age-verification requirements and introduces some of the most aggressive anti-circumvention provisions seen anywhere in the United States.
The law has already triggered a constitutional challenge from Aylo, parent company of Pornhub and several other major adult platforms, setting the stage for what could become one of the most important legal fights in the post-Paxton era of online speech regulation.
Featured In The June 2026 Edition Of XBIZ World
What SB 73 Actually Does
Utah’s SB 73 expands prior age-verification obligations in several significant ways.
Most notably, the law attempts to hold adult websites liable even when Utah users utilize VPNs or other geo-masking technologies to bypass age-verification systems. Under the statute, a user physically located in Utah is deemed to be accessing a website “from Utah” regardless of whether they conceal their location through a VPN, proxy service or similar technology.
The bill also:
- imposes a 2% excise tax on companies subject to Utah’s age-verification rules;
- authorizes administrative enforcement through the Utah Division of Consumer Protection;
- creates civil penalties and damages exposure for alleged violations; and
- prohibits platforms from assisting or encouraging users to circumvent verification requirements through VPN usage.
While lawmakers characterize the measure as a child-protection initiative, critics argue the statute effectively creates strict liability for platforms attempting to comply in good faith with technologically imperfect systems.
That concern is amplified by the practical reality that VPN detection is notoriously unreliable. Residential proxies, rotating IP pools and encrypted routing technologies make accurate geolocation extremely difficult — if not impossible — in many circumstances.
From a technical perspective, the law appears to assume that internet publishers possess near-perfect visibility into user location and browsing behavior. In reality, however, internet routing systems were never designed to function as foolproof geographic identification mechanisms. IP-based geolocation has always involved approximations, and sophisticated VPN services can route traffic through residential or mobile networks that appear indistinguishable from legitimate local users.
That technological gap may become one of the central issues in the litigation. Courts evaluating the statute will likely have to confront whether the government can constitutionally impose liability for failing to prevent conduct that may not be reasonably preventable at all.
Aylo’s Lawsuit Targets the VPN Provision
Aylo’s recent lawsuit specifically challenges the constitutionality and enforceability of the VPN-related provisions of SB 73.
The company argues that Utah is attempting to impose liability based on conduct outside a platform’s reasonable technical control while simultaneously burdening lawful adult access to constitutionally protected speech. According to reporting surrounding the litigation, enforcement of portions of the law has already been temporarily paused while the case proceeds in federal court.
The lawsuit arrives at a critical moment for the adult industry.
In 2025, the U.S. Supreme Court upheld Texas’ age-verification law in Free Speech Coalition v. Paxton, dramatically altering the legal landscape surrounding online age verification. The Court concluded that the Texas framework imposed only incidental burdens on adult speech and survived constitutional scrutiny.
That decision emboldened lawmakers nationwide, including Utah legislators, who have since pushed increasingly aggressive regulatory models.
However, Utah’s SB 73 arguably goes much further than the Texas law at issue in Paxton. Rather than merely requiring age verification, Utah attempts to regulate technological circumvention itself and places the burden of defeating VPN usage squarely on publishers and platforms.
That distinction matters.
Even courts generally supportive of age-verification laws may hesitate when statutes begin imposing liability for conduct platforms cannot realistically prevent. The constitutional analysis shifts from simple age gating into questions involving overbreadth, vagueness, due process and compelled surveillance obligations.
Aylo’s challenge may also test the outer boundaries of dormant Commerce Clause concerns. Because internet traffic routinely crosses state lines and users travel between jurisdictions, state-by-state compliance mandates can create conflicting obligations for publishers operating nationally or globally. Critics argue that allowing individual states to impose inconsistent technical requirements risks fragmenting the internet into a patchwork of localized compliance regimes.
The Privacy Debate Is Intensifying
Another major issue surrounding SB 73 involves user privacy.
Supporters of age-verification laws frequently frame opposition as resistance to child-protection measures. But many civil-liberties advocates, digital-rights organizations and even cybersecurity professionals have warned that mandatory identification systems create substantial privacy and security risks for lawful adult users.
Consumers may be required to upload government-issued identification, facial scans or other sensitive personal data simply to access constitutionally protected content. Even where third-party verification vendors are utilized, concerns remain about data retention, breaches and secondary uses of personal information.
The adult industry has long been a prime target for hacking, extortion and reputational attacks. Critics of aggressive verification laws argue that forcing users to connect their identities to adult browsing habits creates precisely the type of centralized sensitive-data ecosystem that bad actors seek to exploit.
These concerns are not merely hypothetical. Major corporations and government agencies alike continue to experience high-profile cybersecurity breaches despite massive investments in digital security infrastructure. Opponents of laws like SB 73 question whether smaller verification vendors and publishers can realistically guarantee the protection of sensitive consumer data over time.
The Industry’s Broader Concern
For the adult industry, the real concern is not simply Utah.
SB 73 represents part of a growing trend toward increasingly expansive internet regulation targeting adult content providers. What began as age-verification legislation is evolving into a broader framework of mandatory digital identity systems, geolocation enforcement and platform liability expansion.
Critics warn these laws create enormous privacy risks for consumers while pushing users toward unregulated offshore platforms that may have weaker moderation, fewer compliance safeguards and significantly less accountability.
There is also a practical compliance problem.
No platform can guarantee with absolute certainty where every user is physically located at all times. Yet Utah’s law appears to impose liability based on exactly that assumption. If adopted widely, similar laws could force platforms to either implement highly invasive identity-verification systems or block access entirely in large portions of the United States.
Many major adult platforms have already chosen the latter route in certain jurisdictions.
Why This Case Matters
Aylo’s lawsuit may ultimately determine whether states can lawfully force platforms to police VPN usage and impose liability for technological circumvention by users.
If Utah prevails, other states are likely to adopt similar provisions rapidly. If Aylo succeeds, courts may establish meaningful constitutional limits on how far states can go in outsourcing enforcement burdens to online publishers.
Either way, the litigation represents another major chapter in the ongoing collision between online privacy, free speech and state-level internet regulation.
For the adult industry, the outcome could define the next generation of compliance obligations nationwide.
This article does not constitute legal advice and is provided for your information only and should not be relied upon in lieu of consultation with legal advisors in your own jurisdiction. It may not be current as the laws in this area change frequently. Transmission of the information contained in this article is not intended to create, and the receipt does not constitute, an attorney-client relationship between sender and receiver.
About Silverstein Legal
Founded in 2006 by adult entertainment lawyer Corey D. Silverstein, Silverstein Legal is a boutique law firm that caters to the needs of anyone working in the adult entertainment industry. Silverstein Legal’s clients include hosting companies, affiliate programs, content producers, processors, designers, developers, and website operators.
Related Articles
