Utah won’t enforce new VPN rules for Pornhub’s parent company as litigation continues

Utah won’t enforce a new law requiring pornography websites to verify users’ ages even if they hide their location. But the state says the exception is only temporary and just for Pornhub’s parent company as litigation over Utah’s restrictions on adult content websites unfolds. 

Years of legislation and legal fights between Utah and Aylo Freesites, Pornhub’s parent company, led to the platform’s essential exit from the state’s market. However, their dispute isn’t over. The company sued the state over a 2026 law that establishes that Utah rules must be applied for all individuals accessing websites from the state, regardless of whether they use a virtual private network “or other means to disguise or misrepresent the individual’s geographic location.”

“That is impermissible extraterritorial legislation: Utah is projecting its policy choices onto conduct occurring entirely outside its borders, in states and countries that have made different legislative judgments,” the complaint filed in April says. 

The state reached an agreement with Aylo Freesites in late August extending the suspension of the Utah Division of Consumer Protection’s enforcement of the law until the division’s rule takes effect, potentially in October, or when a judge issues a final ruling, whichever is sooner, the division said in a statement on Thursday.

“This agreement is strictly limited to AYLO and is contingent upon AYLO maintaining its geofencing restrictions within Utah,” the division said, adding that “nothing in this agreement precludes the Division from taking enforcement action against other age-assurance non-compliant entities.”

Currently, Aylo is able to identify users who appear to be located in Utah by referencing the IP address associated with their connection to block their access to adult content, the company said. 

Aylo Freesites’ attorneys wrote in the agreement filing that they believe the Utah rule “is fundamentally flawed,” and that the deal doesn’t eliminate their request to block the enforcement of the law. 

However, “this Period of Continued Forbearance allows Plaintiffs to participate in that rulemaking process without the threat of liability in the interim,” the filing says. 

The company’s complaint describes the law as unconstitutional, since “it constitutes impermissible extraterritorial legislation, it violates the dormant Commerce Clause, and it also violates the Foreign Commerce Clause by interfering with purely international transactions involving foreign entities and foreign nationals.”

If the law were to take effect, Aylo would have to pay fines of up to $2,500 for each violation of the law, as well as other actions in court.

Utah had already established an age-verification mandate in 2023 for adult content websites, prompting Aylo to block its free websites in Utah. But, recently the company made “safe for work,” or non-explicit content, which doesn’t fall under the scope of the state’s age-verification law, available to Utah users. 

Some other Aylo sites distribute paid adult content to Utah users. However, those are permitted since customers link a form of identification when paying for their accounts. 

“There is no feasible way for a private company like Aylo to reliably verify whether any particular individual is using a virtual private network (VPN), proxy server, or other location- masking technology — and therefore no way to determine whether a user who appears to be located outside Utah is, in fact, located inside Utah,” the company’s complaint says. “This is not a temporary technological limitation awaiting a solution; it is an inherent feature of how VPNs and proxy servers work.”