A Utah law aimed at preventing minors from accessing explicit content through virtual private networks — or VPNs — is on hold amid a federal lawsuit.
Utah already requires adult websites to verify a user's age. Senate Bill 73, which passed earlier this year, goes a step further.
The new law says those sites are still responsible for keeping minors out even when users try to mask their location with a VPN.
But during a February legislative hearing, Rep. Brady Brammer pressed bill sponsor Sen. Calvin Musselman on a question central to the law's implementation.
"If somebody's using a VPN, they're using it to hide their location," Brammer said. "So, how would the provider know where the individual is?"
"That's a fair question," Musselman responded. "I've talked with consumer protection about that, and I don't know the answer to that. I don't."
That question is now at the center of a lawsuit filed by Aylo, the parent company of Pornhub.
Aylo argues the law puts adult-content platforms in a difficult position.
That’s because it could allow the state to hold websites liable when minors access content through VPNs — even though VPNs are specifically designed to hide a user's location.
State officials disagree.
Katie Haas, the director of Utah's Division of Consumer Protection, says the technology is, “getting there.”
"It's a question of whether they're willing to do it," she said, "not whether they can do it."
She pointed to online gambling systems, particularly in Nevada. Operators there already use age and location verification tools to comply with state laws.
But digital-rights advocates say that comparison only goes so far.
Rindala Alajaji, associate director of state affairs at the Electronic Frontier Foundation, said websites can identify some VPN users, but not all of them.
“You could be based in Utah using a VPN, and it says that your IP address is in the UK," she said, "so it's a technical game of whack-a-mole.”
Alajaji said websites could respond by broadly blocking VPN users altogether or requiring more people to verify their identities.
Because of that, she argued the law could affect users far beyond Utah because companies may choose to apply the same policies nationwide — but even that is not a foolproof solution.
“I think, no matter how much they try to beef up a law to make it accurate or effective, we can't get away from the fact that the internet will always route around censorship," Alajaji said, "and that teens are very tech savvy — whether you like it or not.”
Musselman, who sponsored the bill, declined an interview with UPR. He instead provided a written statement saying the new law simply requires companies to take, “reasonable steps” to keep harmful content away from minors.
For now, Utah has agreed not to enforce the law while the lawsuit moves forward.
