Online age verification is one of those ideas that just won’t go away, even though it’s been proven time and time again to be a bad one.
Not only does it not achieve its stated goal of stopping minors from accessing “adult” content, but it also creates a host of other problems, like privacy and security issues thanks to the harvesting and storing of people’s sensitive information, and – as if that was not enough – it also tends to be used as a tool to censor legal content.
Even though it’s a partial victory, as the rest of the law remains in force, a US district court has blocked one provision of a Utah age verification law.
The case was brought by Aylo Freesites Ltd and Aylo Group Ltd, free adult sites, who went to court to stop the state from enforcing the statute.
US District Judge David Barlow of the District of Utah granted the injunction on September 24, to stop the “actual-location provision” of the law, as he called it, from being enforced.
The provision is contained in Utah Code 78B-3-1002, and is now blocked pending the outcome of the case.
The provision states: “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”
Aylo first sued on April 22, 2026, and Utah has twice agreed not to enforce the law against the company in the meantime – the second such agreement was in force until the injunction was granted.
In his ruling, Judge Barlow said that the provision in question “in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating their location from Utah.”
As the court noted, “there is no way for a website operator to determine a user’s physical location with perfect certainty.”
The law would have required companies to verify age of all users, everywhere, or else try to determine whether a user is actually in Utah by checking device signals, such as time zone, language, and currency settings.
Aylo had argued that the law would require it to “impose age verification on every user of their platforms, everywhere in the world.”
The court said that the provision “does not contain the word ‘reasonable’” – and that nothing in the statute suggests that the efforts to geolocate a user need only be “reasonable.”
The court found that this was a heavy burden on interstate commerce.
The injunction was granted on the basis of the Pike balancing test, which asks whether “the burden imposed on interstate commerce is clearly excessive in relation to the putative local benefits.”
“A court does not ‘uphold an unconstitutional statute merely because the Government promised to use it responsibly’,” Judge Barlow wrote.
The injunction was granted under the dormant Commerce Clause, which the court found was likely to succeed, while it rejected the claim that the provision was impermissibly extraterritorial legislation, and declined to consider the Foreign Commerce Clause argument.
The law’s age verification provision can be satisfied by digital ID, commercial databases “regularly used by government agencies and businesses for the purpose of age and identity verification,” or by transactional records from mortgage, education and employment sources.
Websites are also banned from telling users how to use VPNs to access them.
The suit named the Utah Division of Consumer Protection and its director Katie Hass, the Utah Department of Commerce, and its executive director Margaret Busse, as defendants.
