# Utah's Anti-VPN Law Halted by Federal Judge In a landmark decision for digital rights, a federal judge has granted a preliminary injunction blocking **Utah's SB 73**, the state's stringent anti-VPN age verification law. This ruling underscores the critical disconnect between legislative attempts to regulate the internet and the underlying technical realities, offering a significant win for privacy-conscious users and cybersecurity professionals alike. ## The Scope of SB 73 Signed into law earlier this year, **SB 73** aimed to compel adult websites to either block users employing Virtual Private Networks (**VPNs**) or accurately identify the physical location of visitors using such privacy-enhancing tools. The law went further, prohibiting websites from providing instructions on how to use VPNs to circumvent these checks. This made Utah the first state to explicitly target VPN usage to bypass age-verification gates. The **Utah federal court** halted enforcement of the law's VPN provisions, ruling that the legislation likely violates the U.S. Constitution's prohibition on passing laws that unduly burden businesses and individuals outside Utah's borders. The court found that **SB 73** effectively required adult websites worldwide to implement age verification for every user, or meticulously geolocate and block users specifically from Utah, a logistical and technical impossibility. ## The Legal Challenge and EFF's Involvement The court order follows months of legal challenges. Initially set to take effect in May 2026, **SB 73** faced an immediate constitutional challenge from **Aylo**, the parent company of major online adult platforms like **Pornhub**. The **Electronic Frontier Foundation (EFF)** also submitted formal comments to the **Utah Department of Commerce**, detailing how forcing platforms to detect and block privacy-preserving tools undermines global user privacy and security while demanding the impossible. ## The Ruling: Acknowledging Technical Impossibility **Judge Barlow's** ruling highlighted the fundamental disconnect between the law's requirements and technological capabilities. The judge noted that the statute essentially imposed strict liability on entities like **Aylo** for perfectly determining user location, despite acknowledging that "geolocation perfection is not presently possible." As **EFF** explained in its comments, VPNs protect user privacy by routing traffic through intermediary servers, obscuring the user's true IP address. This makes it impossible for destination websites to reliably ascertain a user's physical location. Consequently, platforms would be left with the untenable choice of blocking all VPN traffic nationwide or withdrawing access entirely from Utah. > "Because the law requires perfection in the absence of perfect geolocation tools, Aylo would need to verify those 28 million users—whether located in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu—to ensure compliance and avoid liability." ## The Proposed Rulemaking and Invasive Surveillance The administrative rules drafted by the state compelled commercial entities to implement "commercially reasonable geolocation obfuscation detection systems." **EFF** argued that this directive not only demands a technical impossibility but also forces an invasive data collection regime onto internet users globally. The proposed detection heuristics, such as monitoring connection latency or device time zones, are notoriously unreliable and prone to misclassification, leading to unwarranted access blocks and significant privacy impacts far beyond Utah's borders. ## What's Next? This preliminary injunction sets an important precedent: state lawmakers must understand the technical realities of the internet before enacting legislation. Mandating invasive tracking and penalizing the use of essential security tools like VPNs turns genuine privacy concerns into mere compliance theater, leading to more state-mandated surveillance. As the cybersecurity community has often stated, the internet will always find ways to route around censorship. While Utah legislators have indicated they may attempt to revise the law, this ruling firmly establishes that technical impossibilities cannot be legislated into reality, safeguarding the privacy and security of internet users.