Utah won't enforce VPN age-verification law until legal challenge resolves

Utah authorities have agreed, at least temporarily, that they won't enforce a law targeting VPN usage in the state. The state's Department of Commerce has said it won't enforce the measure, which went into effect Thursday, while it waits for a federal judge to rule on a legal challenge, Fox 13 News reports.

Utah became the first state in the US to pass a law targeting VPN usage earlier this year as part of a broader crackdown on adult content. Known as SB 73, the measure was positioned by the state's legislature as "amendments" to its age verification law. The law includes a provision that states that any person physically in the state "is considered to be accessing the website from this state" regardless of whether they are using a VPN. It also states that website owners that host "a substantial portion of material harmful to minors may not facilitate or encourage the use of a virtual private network."

While the law stops short of outright banning VPNs — an idea that has been floated in some regions with age verification laws — it does make websites liable for their users' VPN usage, a stance that has alarmed privacy and digital rights advocates. These groups have long warned that a rise in age verification laws could lead to restrictions on VPNs, which would have serious implications for everyone, not just minors trying to evade age detection. That appears to be an increasingly likely reality if the Utah law takes effect, as the Electronic Frontier Foundation explained in April.

"If a website cannot reliably detect a VPN user's true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally," the organization wrote. "This would subject millions of users to invasive identity checks or blocks to their VPN use, regardless of where they actually live."

For now, Utah's law is still in limbo. The measure was originally signed into law in March and meant to take effect in May. But the initial rollout was paused after Aylo, the company that owns Pornhub, challenged the law in federal court. Now, Utah has agreed, once again, to delay enforcement of the law while the court case plays out. It's not clear how long that could take. At a hearing on Thursday, the judge in the case said "he could not commit to when he would issue a ruling," Fox 13 News reported.

Aylo and Pornhub have been among the vocal opponents of age verification laws in Utah and other states. The company has said it doesn't oppose all forms of age verification, but the way the measures have been implemented in the United States have created a "substantial risk" for identity theft and other privacy issues. Pornhub has blocked access in 25 states rather than comply with the laws.