Indiana Attorney General Todd Rokita has filed a lawsuit against Aylo, the company that owns Pornhub and several other adult entertainment platforms, alleging violations of the state’s age verification digital ID law.
We obtained a copy of the lawsuit for you here.
The complaint argues that Aylo failed to stop Indiana residents from using VPNs or proxy tools to access adult material, even though the company had already pulled its services from the state.
Aylo confirmed to AVN that all Indiana-based IP addresses remain blocked.
The company said this was done to comply with the age verification law that took effect earlier this year. Despite that, Rokita’s office insists the move was insufficient and holds Aylo responsible for users who disguise their locations online to bypass the restriction.
In his statement announcing the lawsuit, Rokita framed the issue as one of moral and public health concern. “We know for a fact, from years of research, that adolescent exposure to pornography carries severe physical and psychological harms,” he said.
“It makes boys more likely to perpetrate sexual violence and girls more likely to be sexually victimized.” He accused Aylo of “peddling their pornographic perversions to Hoosier kids,” even though the company has already blocked access from Indiana.
More: From Madison to Moscow: How VPNs Work and Why Governments (Despite Trying) Can’t Stop Them
The lawsuit takes a broad interpretation of Indiana’s age verification law. It claims that Aylo’s IP-based blocking method is unreliable and does not qualify as a “reasonable age verification method.”
The demand that Aylo or any other online platform somehow prevent the use of VPNs is not only reckless in terms of privacy but technically and legally unworkable.
It reflects a misunderstanding of how the internet functions and how deeply privacy tools are embedded in everyday digital life.
Virtual private networks are not obscure circumvention gadgets; they are mainstream infrastructure used by millions of people and organizations worldwide.
VPNs route a user’s traffic through an encrypted tunnel to a remote server, shielding it from interception by third parties such as hackers, advertisers, or even government agencies. Companies use them to secure remote work connections, journalists rely on them to protect sources, and citizens in authoritarian countries depend on them to access uncensored information.
Demanding that a private company identify and block every instance of VPN usage amounts to demanding that it monitor or disrupt encrypted traffic on a massive scale, a task that would erode both privacy rights and network security.
Detecting them with precision would require continuous inspection of encrypted packets, an approach that is both invasive and unreliable. The result would be a cat-and-mouse game that punishes ordinary users who depend on secure connections while doing little to prevent determined circumvention.
