Utah has agreed not to enforce part of its online age-verification law, Senate Bill 73, against Pornhub owner Aylo while a federal judge considers the company’s constitutional challenge.
The law has been in force since May 6, and the challenge against it pertains to the statute’s provision dealing with users who are physically in Utah but use VPNs, proxies, or other tools to make it seem like they are connecting to a website from another location. The law requires that they be treated as if they were accessing the site from Utah, even if the website’s operator can’t determine that.
This is an agreement between the state and Aylo, not an injunction issued by the judge, and it does not apply to other covered websites.
The “Deemed-Location Provision” does not specify how a website should go about determining a user’s actual physical location if it is concealed with the use of VPNs, proxies, or other tools.
The law, however, does list the methods that can be used to verify age, such as digitized ID, third-party services, and information from various databases, as well as “any other commercially reasonable method” using public or private records, including those from mortgage, education, or employment entities.
The law also instructs those providing age verification services not to retain identifying information once a user has been granted access to a site.
News outlets, ISPs, educational material, and “bona fide news and public interest content” are exempt from the law.
Websites that violate SB 73 can face administrative fines of up to $2,500 per violation and civil penalties of up to $5,000 per violation, in addition to other remedies.
Utah’s agreement not to enforce the Deemed-Location Provision against Aylo, whose case challenges it as unconstitutional, was first reported by Utah News Dispatch. The pause in enforcement was initially in place until September 3, but has now been extended until the Utah Division of Consumer Protection adopts a rule, potentially in October, or until the court rules on Aylo’s case, whichever comes first.
The effect of the agreement is that Aylo is not at this time in danger of being punished for not implementing the Deemed-Location Provision, but other companies in the same position remain exposed to enforcement.
The provision is part of the law’s rules that have to do with the use of VPNs, which the legislation does not ban, but rather seeks to regulate in the context of age verification.
One of the problems with the way SB 73 regulates VPNs is that a website receiving a VPN connection may not be able to determine the user’s actual location, as the law requires. To make sure they are in compliance, sites might impose more stringent checks on a wider number of users, or block more connections, which would result in the loss of privacy of adults visiting the site, as they could be subjected to identity checks as well, or lose access to the site.
The law’s sponsor, Republican Senator Calvin Musselman, previously said that the bill targets companies that make money from content harmful to minors and requires them to take “reasonable steps” to keep that content away from children.
He also said that websites can verify a user’s age or state of residence “while still preserving the encryption options for users.”
AdGuard said it would not change its product in Utah because it didn’t believe the law imposes any obligations on VPN providers.
The company’s product chief, Denis Vyazovoy, described VPNs as “general-purpose privacy and security tools,” rather than a loophole used only to bypass age verification.
Gytis Malinauskas, legal chief at Surfshark, another VPN company, has also criticized the approach, saying that it could “erode the privacy of ordinary users” without solving the problem of age assurance.
The court has not taken a stance on this, and the case is ongoing. Meanwhile, Aylo is protected from this provision in Utah, while other covered websites are not.
