Utah will temporarily not enforce a new law that mandates pornography websites verify the ages of users, even if those users employ virtual private networks (VPNs) or other methods to hide their geographic location. This temporary exception applies only to Aylo Freesites, the parent company of Pornhub, as a legal battle over Utah's restrictions on adult content websites unfolds.
The agreement between the state and Aylo Freesites, reached in late August, extends the suspension of enforcement by the Utah Division of Consumer Protection. According to a statement from the division on Thursday, this forbearance period will last until the division’s rule takes effect, which could be in October, or until a judge issues a final ruling, whichever occurs sooner.
This dispute has been years in the making, involving both legislation and legal challenges between Utah and Aylo Freesites. The state's efforts to regulate access to adult content culminated in a 2026 law. This law establishes that Utah's rules must apply to all individuals accessing websites from within the state, regardless of whether they use a VPN or "other means to disguise or misrepresent the individual’s geographic location."
In April, Aylo Freesites filed a complaint against the state, challenging this 2026 law. The company's complaint asserts that this legislation is "impermissible extraterritorial legislation," arguing that "Utah is projecting its policy choices onto conduct occurring entirely outside its borders, in states and countries that have made different legislative judgments." The complaint further describes the law as unconstitutional, citing violations of the dormant Commerce Clause and the Foreign Commerce Clause, which it claims interferes with international transactions involving foreign entities and nationals.
Under the terms of the temporary agreement, the Utah Division of Consumer Protection clarified that it is "strictly limited to AYLO and is contingent upon AYLO maintaining its geofencing restrictions within Utah." The division also specified that "nothing in this agreement precludes the Division from taking enforcement action against other age-assurance non-compliant entities."
Currently, Aylo identifies users who appear to be located in Utah by checking the IP address associated with their internet connection, then blocks their access to adult content, according to the company. However, Aylo’s attorneys wrote in the agreement filing that they believe the Utah rule "is fundamentally flawed" and the deal does not eliminate their ongoing request to block the enforcement of the law. The filing also indicates that this continued forbearance period allows Aylo to participate in the rulemaking process without facing liability during that time.
Aylo Freesites has also contended that there is no practical way for a private company like itself to reliably verify whether an individual is using a VPN, proxy server, or other technology to mask their location. The company's complaint states, "This is not a temporary technological limitation awaiting a solution; it is an inherent feature of how VPNs and proxy servers work." If the law were to take full effect against Aylo, the company would face potential fines of up to $2,500 for each violation, in addition to other court actions.
Before the 2026 law, Utah had already implemented an age-verification mandate in 2023 for adult content websites. This earlier law prompted Aylo to block its free websites from users in Utah. More recently, the company began making "safe for work," or non-explicit content, available to Utah users, as this type of content does not fall under the scope of the state’s age-verification law. Some other Aylo sites continue to distribute paid adult content to Utah users, which is permitted because customers are required to link a form of identification when paying for their accounts. The current agreement focuses specifically on the challenges posed by the newer law's reach into VPN use and location disguise.
