A federal court has paused one of the most aggressive attempts yet to regulate VPN use at the state level. According to the Electronic Frontier Foundation (EFF) and other coverage, U.S. District Judge David Barlow granted a preliminary injunction on Sept. 24 blocking Utah's SB 73, a law that critics described as an anti-VPN age verification mandate. The Utah VPN law injunction is not a final ruling, but it is a significant early win for privacy advocates.
What the court blocked in Utah's SB 73
SB 73 amended Utah's existing adult-content age verification rules. Reporting on the case describes the provision as requiring companies to verify the age of any users physically located in Utah, regardless of how they connect. In practice, that meant a person in Utah using a VPN to appear elsewhere could still trigger legal responsibility for the website they visited.
That is what set the law apart. Earlier age verification laws generally asked sites to check the age of visitors who appeared to be in a given state. This approach shifted the focus to a user's actual physical location, which a platform cannot see directly when a VPN is in the way. Coverage notes that the case was brought by the owner of Pornhub, and the court sided with the plaintiff in blocking Utah from enforcing the provision while the case continues.
A preliminary injunction means the judge found enough merit in the challenge to stop enforcement for now. The underlying legal fight is not over, and the state may appeal or continue to defend the law.
Why detecting VPN users is technically impossible
EFF's central argument, which the court accepted according to the angle of its reporting, is that the law demands something platforms cannot do. EFF also submitted comments to the Utah Department of Commerce detailing how forcing platforms to detect and block VPN users does not work as the law assumes.
The reasoning is easy to follow even without a networking background. When you connect through a VPN, a website generally sees the address of the VPN server, not your home connection. Many people share that same address at once, and it may be located in another city, state, or country. The site has no reliable way to look behind it and confirm where one particular visitor is sitting.
A law that holds a platform liable for Utah users it cannot identify creates a few problems:
- No dependable signal. If the location information is hidden by design, a platform is left guessing.
- Collateral damage. Blocking suspected VPN traffic would also hit people using VPNs for ordinary reasons, such as protecting data on public Wi-Fi or securing remote work.
- Pressure toward broader checks. If a site cannot tell who is in Utah, the safest compliance path may be to verify everyone, which raises its own privacy concerns.
VPNs are widely used for legitimate security and privacy purposes, and a rule that effectively treats them as a loophole to be closed puts all of those uses at risk.
What this means for age verification and VPN access elsewhere
Utah was described in public discussion as the first state to hold websites liable for users who mask their location. That makes the outcome worth watching beyond its borders. Lawmakers in other states weighing age verification rules may see VPNs as the obvious gap, and Utah's approach could have served as a template.
A court finding the core requirement unworkable sends a signal, even though an injunction from one federal district court does not bind other states. Legislators drafting similar language will now have to account for a documented judicial finding that VPN detection cannot be done reliably. Platforms and advocacy groups challenging future laws also have a clear roadmap for their arguments.
It is also worth separating two debates that often get blended together. One is whether minors should be kept away from adult content. The other is how, and at what cost to everyone's privacy, that goal is pursued. The Utah case is mostly about the second question: whether a law can require something that the technology does not allow.
What This Means For You
If you live in Utah or travel there, the ruling means you remain free to use a VPN as you did before. The provision that would have pushed platforms to treat VPN connections as a compliance problem cannot be enforced for now.
For everyone else, the practical effect is less direct but still real. Age verification rules are spreading, and each one raises questions about what data you hand over and who stores it. A VPN does not replace careful choices about which sites you trust with identity documents or personal details.
Keep in mind the limits of this decision too. It is preliminary, and the law could return in a modified form if the state wins on appeal or the legislature rewrites it.
What privacy-conscious users should watch next
Several developments will show whether this win holds:
- Appeals and the final ruling. Watch whether Utah challenges the injunction or the case proceeds to a full decision.
- Rulemaking. EFF's comments to the Utah Department of Commerce show that regulators are still shaping how these rules would work in practice.
- Copycat bills. Pay attention to whether other states introduce language targeting VPN users or physical location.
- Platform behavior. Some sites respond to age verification mandates by restricting access entirely, which can affect people well outside the state in question.
Actionable takeaways
- Continue using a VPN for legitimate privacy and security needs; nothing in this ruling changes that.
- Be cautious about uploading ID or biometric data to any site for age checks, and read what it says about retention.
- Follow your own state's legislative agenda for age verification and VPN-related proposals.
- Stay informed, because the Utah VPN law injunction is one step in a longer fight over how far states can reach into the way people connect to the internet.
The court's acceptance that VPN detection is technically impossible is a useful marker for lawmakers and users alike. We will keep tracking how state age verification and VPN rules develop, so check back for updates on your digital privacy rights.
