Utah has once again positioned itself at the center of the national battle over online age verification and adult-content regulation.
With the enactment of SB 73, formally titled the “Online Age Verification Amendments,” Utah lawmakers significantly expanded the state’s existing regulatory framework governing adult websites. The legislation goes far beyond traditional age-verification requirements and introduces some of the most aggressive anti-circumvention provisions seen anywhere in the United States.
For the adult industry, the real concern is not simply Utah. SB 73 represents part of a growing trend toward increasingly expansive internet regulation targeting adult content providers.
The law has already triggered a constitutional challenge from Aylo, parent company of Pornhub and several other major adult platforms, setting the stage for what could become one of the most important legal fights in the post-Paxton era of online speech regulation.
What SB 73 Actually Does
Utah’s SB 73 expands prior age-verification obligations in several significant ways. Most notably, the law attempts to hold adult websites liable even when Utah users utilize VPNs or other geo-masking technologies to bypass age-verification systems. Under the statute, a user physically located in Utah is deemed to be accessing a website “from Utah” regardless of whether they conceal their location through a VPN, proxy service or similar technology.
The bill also:
- imposes a 2% excise tax on companies subject to Utah’s age-verification rules;
- authorizes administrative enforcement through the Utah Division of Consumer Protection;
- creates civil penalties and damages exposure for alleged violations; and
- prohibits platforms from assisting or encouraging users to circumvent verification requirements by using VPNs.
While lawmakers characterize the measure as a child-protection initiative, critics argue that the statute effectively imposes strict liability on platforms that attempt to comply in good faith with technologically imperfect systems.
Aylo’s Lawsuit Targets the VPN Provision
Aylo’s recent lawsuit specifically challenges the constitutionality and enforceability of the VPN-related provisions of SB 73. The company argues that Utah is attempting to impose liability for conduct beyond a platform’s reasonable technical control while simultaneously burdening lawful adult access to constitutionally protected speech. According to reports on the litigation, enforcement of certain provisions of the law has been temporarily paused while the case proceeds in federal court.
The lawsuit arrives shortly after the U.S. Supreme Court upheld Texas’s age-verification law in Free Speech Coalition v. Paxton, a ruling that emboldened lawmakers nationwide to pursue more aggressive regulatory models.
However, Utah’s SB 73 arguably goes much further than the Texas law at issue in Paxton. Rather than merely requiring age verification, Utah attempts to regulate technological circumvention itself and places the burden of defeating VPN usage squarely on publishers and platforms.
Even courts generally supportive of age-verification laws may hesitate when statutes begin imposing liability for conduct that platforms cannot realistically prevent. The constitutional analysis shifts from simple age gating to questions involving overbreadth, vagueness, due process and compelled-surveillance obligations.
Aylo’s challenge may also raise dormant Commerce Clause concerns, as critics argue that conflicting state-by-state compliance mandates risk fragmenting internet regulation nationwide.
The Privacy Debate Is Intensifying
Another major issue surrounding SB 73 involves user privacy. Supporters of age-verification laws frequently frame opposition as resistance to child-protection measures. However, many civil liberties advocates, digital rights organizations, and even cybersecurity professionals have warned that mandatory identification systems pose substantial privacy and security risks for lawful adult users.
Consumers may be required to upload government-issued identification, facial scans or other sensitive personal data to access constitutionally protected content, raising concerns about retention, breaches and secondary uses.
The adult industry has long been a prime target for hacking, extortion and reputational attacks. Critics of aggressive verification laws argue that forcing users to connect their identities to adult browsing habits creates precisely the type of centralized sensitive-data ecosystem that bad actors seek to exploit.
The Industry’s Broader Concern
For the adult industry, the real concern is not simply Utah. SB 73 represents part of a growing trend toward increasingly expansive internet regulation targeting adult-content providers. What began as age-verification legislation is evolving into broader digital identity and platform-liability regulation.
Critics warn these laws create enormous privacy risks for consumers while pushing users toward unregulated offshore platforms that may have weaker moderation, fewer compliance safeguards and significantly less accountability. Many major adult platforms have already chosen to block access entirely in certain jurisdictions.
Why This Case Matters
Aylo’s lawsuit may ultimately determine whether states can lawfully force platforms to police VPN usage and impose liability for technological circumvention by users.
If Utah prevails, other states are likely to adopt similar provisions rapidly. If Aylo succeeds, courts may establish meaningful constitutional limits on how far states can go in outsourcing enforcement burdens to online publishers. Either way, the litigation represents another major chapter in the ongoing collision between online privacy, free speech and state-level internet regulation.
For the adult industry, the outcome could define the next generation of compliance obligations nationwide.
This article does not constitute legal advice and is provided for information purposes only.
Corey D. Silverstein is the managing and founding member of Silverstein Legal, which represents all areas of the adult industry. His clientele includes hosting companies, affiliate programs, content producers, processors, designers, developers, operators and more. He is licensed in numerous jurisdictions. Contact him via MyAdultAttorney.com, corey@silversteinlegal.com or 248-290-0655.
