The state of Utah is moving to enforce a part of its online age verification law that a federal court has not blocked – and that means that adults will have to start proving their age in order to access “adult” sites.
Utah’s Department of Commerce and Division of Consumer Protection announced on Friday that it will start enforcing the age verification requirement from Monday, November 2, as it applies to sites that the law, SB 73, says must implement “reasonable age verification methods.”
This is happening while a federal court is still blocking another part of the same law, and a lawsuit against it is paused. The law says that sites where more than 33-1/3% of total material is what it considers to be “material harmful to minors” must make sure that people under 18 cannot access that content.
They must do it by using “reasonable age verification methods.” The law spells out what it means by that: a “Digitized identification card,” a third-party service that checks a user’s details against a database “regularly used by government agencies and businesses for the purpose of age and identity verification,” “any commercially reasonable method that relies on public or private transactional data,” or any method the division sets by rule.
There is a promise on paper that the site or the third party used for verification “shall not retain any identifying information of the individual after access has been granted.” But promises like this have proven to be hollow in the past – in 2025, a breach at the analytics firm Mixpanel exposed the email addresses, approximate locations, search terms, and viewing histories of people who had accounts on the site Pornhub.
The division now says that sites have “access to established, commercial grade age-assurance tools” and that it will use “specialized computing and auditing infrastructure” to check if sites are complying with the law. Exemptions are “bona fide news or public interest” material, internet service providers, search engines, cloud providers.
The part of the law that the court blocked was the one that said a person is considered to be in Utah if they are “actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means.” U.S. District Judge David Barlow ruled in favor of the plaintiff, Aylo Freesites, saying, “It is undisputed that geolocation perfection is not presently possible.”
The rest of the law remained in force, and the division is now moving to enforce the part of it that deals with age verification.
While the case is paused at both sides’ request until at least March 19, 2027 – to give the legislature a chance to revisit the law during its 2027 session (January 19 to March 5) – the division has announced it will start enforcing the rule that is still in force.
The law also says that sites may not “facilitate or encourage the use of a virtual private network” to get around the age checks, and this includes providing instructions on how to use a VPN.
The division can fine sites up to $2,500 for each violation, while breaking an order brings a civil penalty of no more than $5,000 for each violation, in addition to court orders, fees, and costs.
SB 73 also introduced a tax on covered sites, to the tune of 2% of the sales price of covered transactions, which has been in effect since October 1. The money goes into the “Minor Online Safety Restricted Account” – which is used to fund the division’s own activities, including the enforcement of this law.
The bill’s sponsor, Sen. Calvin Musselman, said, “The enforcement of age verification for adult websites is a necessary step to ensure that Utah’s youth are shielded from explicit material.”
Local media reported that it is not known at this time whether Aylo will ask the judge to lift the pause and continue with the lawsuit.
We previously reported that SB 73 is amending Utah’s 2023 adult-site age verification law, and that the VPN rule took effect on May 6.
In the meanwhile, Google has added tools to signal a user’s age as Texas, Utah, and Louisiana are enforcing their age verification laws.
Utah is not alone in trying to implement this type of legislation, and not the only one to face legal challenges to it. But it is now using the part of the law that has not been blocked to reach all internet users in the state.
While the blocked provision tried to force sites to geolocate users in Utah, even if they used a VPN – which the court said was not technologically possible – the part that is now being enforced reaches every adult in the state who visits these sites and requires them to verify their age using a digital ID, a third-party service that checks their details against a database, or their financial records.
The state promises that this data will not be kept, but the same promise has been made and broken before. Meanwhile, the law is setting up a self-sustaining enforcement mechanism, as fines and penalties will go into the Minor Online Safety Restricted Account, which funds the division’s activities.
