Virtual private networks (VPNs) have long offered an easy way to circumvent online porn blocks, but a legal battle is unfolding in Utah that is likely to have wider repercussions for this common VPN workaround.
Like many US states, Utah recently toughened age verification laws for online porn access. The state has gone further than others, and is believed to be the first to make porn sites responsible for verifying the age of users in Utah who are using a VPN to hide their IP address and connect via a VPN server outside Utah.
Now Aylo, which owns Pornhub, RedTube, and YouPorn, has sued Utah over the VPN expansion, a move that makes sense in the context of the company’s broader strategy. Aylo has been lobbying Apple, Google, and Microsoft for device-level age verification as the alternative to site-level compliance, and a Utah precedent that forces site-level VPN detection would directly undermine that position. Aylo is suing to stop enforcement of the law, saying it breaches constitutional restrictions on states legislating outside their borders.
If Aylo loses the case, and Utah goes on to successfully enforce the VPN responsibility law, it could be the beginning of the end of VPN use being a quick and easy porn block workaround in the US.
Aylo’s constitutional argument
Dozens of US states have toughened age verification laws in recent years, but many users in these states have simply used VPNs to dodge the new, more robust verification processes. When Utah toughened age verification rules in 2023, the number of online searches for VPNs in the state skyrocketed.
Utah has sought to lead the way in cracking down on this common and easy loophole, enabled by many VPNs being available for free or low costs. The state’s SB17 age verification for porn bill, introduced in 2026, made it clear that sites were still legally responsible for age verification even while users accessed them while using a VPN.
The bill reads: “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”
SB17 would also make it illegal for sites to encourage or advise users to use VPNs to circumvent age verification processes.
Rather than implement site-level age verification for Utah-based users, Aylo has blocked access to its sites in the state, the same tactic it’s deployed across more than a quarter of US states and, more recently, in Australia. The company’s position is consistent: site-level verification is unworkable, and the block is a protest as much as a compliance measure. The company argues that the age verification rules are unworkable, and has lobbied authorities and tech firms to focus on device-level age verification rather than placing responsibility with sites.
Now Aylo, in its lawsuit against Utah, is arguing that to implement the state’s rules regarding VPN use it would have to verify the age of all of its sites’ users around the world, to account for any potential Utah-based VPN users. This, Aylo says, violates the US Constitution’s clauses on interstate and foreign commerce.
Aylo said in the lawsuit: “The Deemed-Location Provision [in the age verification law] thus transforms what is nominally a Utah regulation into a de facto global mandate… no state has ever before enacted this type of Deemed-Location Provision. Nor has any state attempted to give its age-verification framework such sweeping global coverage.”
“Injunctive relief is necessary”
Aylo was already blocking access to its porn sites in Utah before the VPN law was put forward, due to an earlier age verification law. Still, it’s understandable why the company is keen for a VPN crackdown precedent to not be set in the state. If Utah fends off legal challenges and implements the law robustly, and other states follow suit, traffic to some of the world’s biggest porn sites would take a serious hit.
Porn site companies like Aylo would no longer simply be able to block access state-wide, and would likely have to introduce technology to recognise and block VPN-routed users: a potentially expensive and complex process that might well not be workable at all.
Aylo said in the lawsuit: “This new law is unconstitutional for three independent reasons: it constitutes impermissible extraterritorial legislation, it violates the dormant Commerce Clause, and it also violates the Foreign Commerce Clause by interfering with purely international transactions involving foreign entities and foreign nationals. Given the significant harms that Aylo faces if Utah’s law is allowed to go into effect, preliminary and permanent injunctive relief is necessary.”
Utah state has agreed to delay enforcement of the VPN-related porn access rules until September 3, 2026, so the case can work its way through the courts. And although Utah is considered a trailblazer in focusing on VPN use for porn access, there are signs that other states are looking to crack down.
In Ohio a bill has been passed that, if it fully becomes law, would require porn sites to use geofence systems to determine if a user is physically in Ohio and subject to age verification process rules or not.
As Aylo continues to hold the line of blocking site access in states toughening age verification, all eyes will be on the company’s Utah lawsuit as it tests the mettle of what for so long has looked like an unshakable workaround.
