On September 24, U.S. District Judge David Barlow put a preliminary stop to one sentence of Utah’s age-verification statute — the clause that counted you as a Utah user even when a VPN made your connection look like it originated in Finland. Aylo Freesites, the company behind Pornhub, brought the challenge. The Electronic Frontier Foundation, which had filed formal comments against the rules that the Utah Division of Consumer Protection published on September 1, published a deeplinks post on October 1 titled “Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility.” Those rules could have taken effect as soon as October 8. Now they can’t, pending further litigation.

Everyone who saw the link this week read it as a rout. Read the order instead.

The Order Amputates One Sentence and Leaves the Statute Standing

Barlow’s ruling pauses a provision. It does not touch the requirement that adult sites deploy “reasonable age-verification methods” — the part that actually asks a website to determine the age of everyone who walks in, and the part that has been operating for months. Utah SB 73 was signed earlier this year. The VPN clause was the addendum, the bit that made the whole scheme legible as farce. The court removed the farce. The scheme remains.

That matters because of what the farce was doing for the other side. An impossible requirement is a gift to litigants: it delivers a clean, sympathetic argument that requires no jury to accept that age verification itself is the problem. All you have to prove is that IP geolocation behind a commercial VPN is unreliable. You can prove that in an afternoon. It’s true. And it is beside the point.

A preliminary injunction is not a precedent. It is a stay of execution for one clause of a statute that is otherwise humming along.

One committee staffer, reached in the parking garage of the Utah Capitol between votes, put it more bluntly than his boss would have liked: “Nothing in this order stops us from requiring an ID. It stops us from requiring a magic trick.”

What Replaces VPN Geolocation Is Worse and Much Harder to Sue

Here is the uncomfortable part for anyone trading the EFF link around this week. Legislatures respond to impossibility by rebuilding the thing so that it becomes possible.

The obvious rebuild is the device. California’s AB 1043, the Digital Age Assurance Act, starts in 2027 and asks websites to guess nothing — the operating system collects an age bracket at setup. Utah’s own app-store law, SB 142 and HB 498, went into effect September 1 and sits enjoined pending appeal. Texas SB 2420 was enjoined at the start of the year. Louisiana HB 570 took effect July 1. Alabama HB 161 arrives January 1. That is a large share of the map already migrating to a model in which Apple or Google attests to your age and hands the signal downstream — and the federal App Store Accountability Act, H.R. 3149, waits in the 119th Congress with data-minimization language that reads, to anyone who has watched one of these mandates get built, like a promise about the shape of the vault rather than its existence.

You cannot call device-level attestation a technical impossibility. It is an API call. It is the lightest compliance burden a platform has ever been handed, which is precisely why it is the durable version — and why the litigation strategy that just worked in Utah is worthless against it. A judge cannot rule that something is impossible when it could ship by Thursday. So every win against a location rule pushes the law toward attestation: more effective, more centralized, and far harder to challenge. Losing beautifully is how this regime has been winning.

Everyone in This Case Got What They Wanted Except You

Score the September 24 order honestly. Aylo keeps its users out of Utah’s enforcement machinery without ever having to argue, in open court, that age-gating a website is bad policy. Utah keeps its age-verification mandate and loses only the clause its own lawyers probably suspected was trouble. The EFF gets a genuine, well-earned win on the technical merits and a headline that will be cited for years. And the identity infrastructure — the part that requires every adult in a state to prove something about themselves to a screen — goes unexamined by all three.

The right should be the most uncomfortable here, and isn’t. A movement that spent a decade complaining about the administrative state just watched a state affiliate build the most elaborate age-identity layer in the country and call it child protection, while the courts obligingly trim the ugly bits off so the rest survives review. That is not a setback for the mandate. That is a compliance department.

What got struck down this week was the version of the law that was easy to mock. What got preserved was the version that works.

Sources