Legal Victory: Court Rules Utah's VPN Restrictions are Technically Impossible

When state governments attempt to legislate the fundamental architecture of the internet, the judiciary serves as a critical check to ensure that laws do not demand the impossible. This is precisely what occurred recently when a federal court stepped in to stop Utah from dismantling the privacy protections provided by Virtual Private Networks (VPNs).

In a significant win for the preservation of digital rights, a federal judge granted a preliminary injunction to halt the enforcement of SB 73, a restrictive age-verification law passed by the state of Utah.

Understanding SB 73

Enacted earlier this year, SB 73 sought to regulate adult-oriented websites by imposing strict requirements on how they handle users who mask their network traffic. Specifically, the law mandated that these platforms:

• Block any user utilizing a VPN.
• Identify the precise physical location of visitors using privacy-preserving tools.
• Provide guidance Prohibit the sharing of instructions on how to use VPNs to circumvent these age-verification gates.

To the best of the EFF's knowledge, this made Utah the first state to specifically target VPN usage as a means of bypassing legally mandated age checks.

The Burden of Compliance

The court found that SB 73 likely violates the U.S. Constitution because it places an undue burden on individuals and businesses located outside of Utah's jurisdiction.

"The law’s 'actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating," the court noted.

Essentially, for a website to ensure no Utah minor was accessing their content via a VPN, they would have to verify the identity and location of every single global visitor.

The Legal Timeline

The road to this injunction involved several months of strategic legal challenges.

• Law Passed: SB 73 signed into law.
• Lawsuit Filed: Aylo (parent company of Pornhub) challenged the constitutionality of the law.
• Enforcement Pause: Utah and Aylo agreed to a temporary stay while the court reviewed the injunction.
• Rule Publication: On September 1, 2026, the Utah Department of Commerce published proposed compliance rules (R152-78B).
• EFF Intervention: EFF submitted formal comments opposing the rules.
• Proposed Effective Date: October 8, 2026 (Now blocked by the court).

The "Technical Impossibility"

Judge Barlow's ruling highlighted a massive gap between legislative ambition and technical reality. The court acknowledged that SB 73 essentially creates a system of strict liability, where a company is penalized if they cannot geolocate a user with 100% accuracy.

Comparison: Legal Demand vs. Technical Reality

How VPNs Work

To explain why this law is a fantasy, we can look at the logic of a VPN connection. A VPN acts as an intermediary, meaning the destination server never sees the user's actual IP address.

In mathematical terms, the website sees the identity of the proxy, not the origin: $\text{Visible IP} = \text{VPN Server IP} \neq \text{User's Actual IP}$

Because the website only sees the server's address, there is no reliable way to distinguish if the traffic is coming from Salt Lake City, Seattle, or Shanghai.

def check_location(user_ip):
    if user_ip == "VPN_SERVER_IP":
        return "Unknown/Masked"
    else:
        return "Actual Location"

# Under SB 73, "Unknown/Masked" results in legal liability.

Conclusion

The EFF strongly supports Judge Barlow’s decision. By recognizing that "geolocation perfection is not presently possible," the court has prevented a dangerous precedent where states can demand technical miracles under threat of law.

While Aylo's current lawsuit does not challenge the ban on sharing VPN instructions, the blocking of the main VPN provisions is a massive victory for global internet privacy.