News

Utah VPN Rule Enforcement Pause Extended in Aylo Lawsuit

August 29, 2026

SALT LAKE CITY — Provisions of a Utah law making adult websites liable if minors in the state circumvent geolocation efforts to bypass age verification, which were set to come into force in May, have again been put on hold temporarily.

In April, Pornhub parent company Aylo filed a complaint with the U.S. District Court for the District of Utah, Central Division, seeking an injunction against the “deemed-location” provision of Utah’s SB 73, which was signed into law in March. The renewed “period of forbearance” therefore continues to apply technically only to sites operated by Aylo — though according to industry attorney Corey Silverstein, Utah would find it impractical to enforce the law against any site or company until the pending motion for preliminary injunction is ruled upon. However, Silverstein emphasized that sites and companies should still consult with their own legal counsel in the matter as they may still be subject to enforcement actions.

The law’s “deemed location” provision states: “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”

In its complaint, Aylo contended that the deemed-location/VPN provisions of the law threaten adult entertainment companies with civil penalties and potential criminal liability unless they implement Utah’s age-verification regime “for every user of their platforms, anywhere in the world,” which the company argues would constitute “impermissible extraterritorial legislation” since Utah is “projecting its policy choices onto conduct occurring entirely outside its borders, in states and countries that have made different legislative judgments.”

The complaint also argued that the law violates the dormant Commerce Clause and Foreign Commerce Clause by “imposing significant burdens on, and purporting to regulate, the national and international markets for adult entertainment.”

In May, Aylo and the Utah Division of Consumer Protection agreed to the period of forbearance under which the VPN provisions would not be enforced against Aylo until Sept. 3, or longer if the court should require more time to issue a decision.

Earlier this month, however, the Utah Division of Consumer Protection issued a proposed rule implementing SB 73, including criteria for what constitutes an acceptable standard for addressing “geolocation obfuscation.” The rule is planned to take effect Oct. 8.

As a result, the parties in the case agreed on Thursday to extend and continue the period of forbearance until Oct. 22, which is two weeks after the effective date of the proposed rule, or until the Court resolves Aylo’s pending motion for a preliminary injunction, whichever comes earlier.

The parties’ joint stipulation states: “Although Plaintiffs believe that the proposed rule is fundamentally flawed and does not eliminate their claims or the need for relief, this Period of Continued Forbearance allows Plaintiffs to participate in that rulemaking process without the threat of liability in the interim. Additionally, this Period of Continued Forbearance provides the Court with additional time to resolve the current motion for a preliminary injunction, including the discretion to await the outcome of the rulemaking before deciding the motion.”

As XBIZ has reported, the VPN provision in the Utah law reflects growing concern about the widespread use of techniques to circumvent age verification, which has inspired both state and federal efforts to close that practical loophole.

The Utah Division of Consumer Protection is accepting public comments on the rule until Oct. 1.

View Document

WASHINGTON — A Republican congressman has introduced legislation to bar U.S. courts from helping to enforce any foreign law restricting speech that would domestically be protected under the First Amendment, potentially including foreign age verification laws.

On Thursday, Rep. Michael Rulli of Ohio introduced the Guaranteeing Rights Against Novel International Tyranny and Extortion (GRANITE) Act, which would prohibit domestic courts from recognizing or enforcing “a foreign judgment, or a fine, order, or demand issued by a foreign court or a foreign state, enforcing a foreign censorship law.”

The bill defines “foreign censorship law” as any law of a foreign state that “has the primary purpose or substantial effect of restricting or penalizing expression, expressive conduct, or expressive association; targets expression, expressive conduct, or expressive association based on its content, viewpoint, or speaker identity; or compels disclosure that would reasonably chill that expression, expressive conduct, or expressive association; and would conflict with the protections of the First Amendment of the United States Constitution if recognized in the United States.”

This language raises the question of whether or not age verification laws, such as the AV provisions in the EU’s Digital Services Act (DSA) and the U.K.’s Online Safety Act (OSA), would be classified as foreign censorship laws. If so, the GRANITE Act could potentially protect U.S.-based adult sites from domestic enforcement of those laws, such as pursuing fines against U.S.-based sites. Foreign governments and agencies could still take domestic measures such as blocking U.S. sites within their own territory, however.

Free-speech advocates argue that AV laws target expression based on content and also chill expression, factors that point to classification as censorship under the GRANITE Act. Additionally, the GRANITE Act was conceived by attorney Preston Byrne, who has represented the online forum 4chan in opposing U.K. media regulator Ofcom’s attempts to force that platform to implement AV measures to prevent minors from accessing pornography.

In the pivotal case Free Speech Coalition v. Paxton, however, the Supreme Court declared that “the First Amendment leaves undisturbed States’ traditional power to prevent minors from accessing speech that is obscene from their perspective. That power includes the power to require proof of age before an individual can access such speech. It follows that no person — adult or child — has a First Amendment right to access such speech without first submitting proof of age.” The court upheld the constitutionality of state AV laws so long as they only “incidentally” burden the protected speech of adults. This suggests that AV laws conforming to that rule would not fit the bill’s definition of “foreign censorship.”

Industry attorney Lawrence Walters told XBIZ that, should the GRANITE Act become law, U.S. companies subject to foreign judgments based on purported violations of AV laws could argue that such laws fit the bill’s definition of foreign censorship.

“It would be up to a reviewing court whether the Supreme Court’s decision in Paxton precludes these arguments,” Walters explained. “Each foreign law would need to be independently evaluated against the holding of Paxton. Some foreign laws go far beyond sexual expression when defining ‘harmful content.’ Therefore, the Paxton reasoning may not apply to some of these laws, thereby potentially shielding U.S. operators from foreign judgments.”

Industry attorney Corey D. Silverstein agreed that the GRANITE Act could provide U.S.-based companies with a meaningful defense against domestic enforcement of certain foreign online age verification laws, if those laws satisfy the bill’s criteria for constituting censorship, “particularly when their application depends on the content being accessed or when they require users to disclose identifying information as a condition of accessing protected speech.”

“The analysis would ultimately depend on the precise coverage, verification methods, privacy protections and enforcement mechanisms of the particular foreign law,” Silverstein told XBIZ. “The more difficult requirement is that recognition of the foreign law must conflict with the First Amendment.

“In Free Speech Coalition v. Paxton, the Supreme Court held that Texas’ requirement for age verification on websites substantially devoted to sexual material harmful to minors imposed only an incidental burden on adults’ protected speech,” Silverstein elaborated. “Accordingly, if a foreign AV law is directed specifically at minors’ access to material that is obscene as to minors, allows adults access after reasonable age verification, and is adequately tailored, then Paxton would support an argument that recognizing the law would not conflict with the First Amendment. In that circumstance, the law might fall outside GRANITE’s definition.”

Rulli is not the only elected official advocating for such a federal law. Republican Senator Eric Schmitt of Missouri stated last year that he intended to introduce similar legislation. At the state level, Wyoming earlier this year weighed its own version of the GRANITE Act, which passed the state House but failed to advance in the state Senate.

Trump administration officials have also repeatedly characterized European content laws as an attack on free speech, going so far as to impose visa restrictions on EU figures the administration perceives as leading “efforts to coerce American platforms to censor, demonetize, and suppress American viewpoints they oppose.” This may indicate potential administration support for the GRANITE Act, should it advance in the legislative process.

The bill has been referred to the House Committee on the Judiciary.