SALT LAKE CITY — A federal court on Thursday issued a preliminary injunction preventing the state of Utah from enforcing a legal provision that would make adult websites liable if minors in the state circumvent geolocation efforts in order to bypass age verification.
In April, Pornhub parent company Aylo filed a complaint with the U.S. District Court for the District of Utah, Central Division, seeking an injunction against the “deemed-location” provision of Utah’s SB 73, an AV bill that was signed into law in March.
That provision reads: “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”
As XBIZ has reported, the VPN provision in the Utah law reflects growing concern about the widespread use of techniques to circumvent age verification, which has inspired both state and federal efforts to close that practical loophole. Aylo is currently also the defendant in a lawsuit brought by the state of Indiana, which contends that the company violated that state’s age verification law by failing to prevent access by users who employ VPNs and similar means to avoid geolocation.
In its Utah complaint, Aylo contended that the deemed-location/VPN provisions of the law threaten adult entertainment companies with civil penalties and potential criminal liability unless they implement Utah’s age-verification regime “for every user of their platforms, anywhere in the world,” which the company argues would constitute “impermissible extraterritorial legislation” since Utah is “projecting its policy choices onto conduct occurring entirely outside its borders, in states and countries that have made different legislative judgments.”
The complaint also argued that the law violates the dormant Commerce Clause by “imposing significant burdens on, and purporting to regulate, the national and international markets for adult entertainment.”
The VPN provision was set to come into force in May, but was put on hold temporarily after Aylo and the Utah Division of Consumer Protection agreed to a period of forbearance during which enforcement would be suspended. That period of forbearance was extended after the Utah Division of Consumer Protection issued a proposed rule detailing how SB 73 should be implemented, including criteria for what constitutes an acceptable standard for addressing “geolocation obfuscation.”
That rule was planned to take effect Oct. 8, but Thursday’s order by District Judge David Barlow means that it cannot be enforced pending further action by the court.
“Plaintiffs have demonstrated that Utah Code section 78B-3-1002(3), the actual-location provision, is likely to violate the United State Constitution’s dormant Commerce Clause, that irreparable harm will result, and that the equities favor an injunction,” Barlow wrote. “Accordingly, the court hereby enters a Preliminary Injunction as follows: That Defendants and their agents, employees, and persons in active concert or participation with them shall not enforce Utah Code section 78B-3-1002(3) until further order of this court.”
The order does not prevent Utah from enforcing other provisions of its AV law.
An Aylo rep told XBIZ, "We are pleased with the court’s ruling and appreciate its careful consideration of the issues. We remain committed to complying with applicable law while safeguarding user privacy and security."
The rep added that, although Aylo believes Utah’s age verification law does not sufficiently protect users’ privacy, that law is not at issue in this case.
"To be clear, age verification is a good thing, if done correctly," the Aylo rep said. "We have long worked with governments around the world to better protect kids online. Age verification legislation in other jurisdictions is failing for a number of reasons, including its inconsistent and ineffective enforcement at scale, leaving hundreds of thousands of platforms with age-inappropriate content accessible, most of which do not have content moderation or uploader verification measures."
Possible Next Steps
Utah can appeal the order, but will likely face an uphill fight defending the VPN provision in court, industry attorney Corey Silverstein told XBIZ.
“The statutory wording is a significant obstacle,” Silverstein observed. “The judge read it to require websites to identify every user physically in Utah, including users whose locations are masked by VPNs, without allowing for reasonable mistakes. Because perfect geolocation is not possible, the court concluded that avoiding liability would effectively require age checks for users outside Utah.”
The judge deemed such a requirement to violate the Commerce Clause. The legislature could also revise the provision, but would have to do so in a way that satisfies the court.
“Any revision would still have to be assessed on its actual wording and effect,” Silverstein noted.
Attorney Lawrence Walters called the ruling “a reminder that states cannot solve a technology problem by writing an impossible duty into the code.”
“After Free Speech Coalition v. Paxton, states have more room to require age verification,” he told XBIZ. “However, they do not have license to export that duty to every user on Earth because some Utahns use VPNs. For legislatures, the lesson is ‘Draft for the internet as it actually exists. Do not impose strict liability for a determination no website can make with certainty.’”
Once the case is decided, the final verdict could potentially impact other litigation such as the Aylo/Indiana case, as well as the enforceability of other legislation addressing VPN use as it relates to age verification.
