Federal judge blocks Utah's VPN rule because obeying it meant age-checking every user worldwide

Someone in Utah on hotel Wi-Fi switches on a VPN. The court called that kind of use legitimate, listing the securing of communications on public networks among the reasons people do it ^[4]. Their traffic now exits through an address somewhere else ^[4]. Under this year's amendment, that person still counts as located in Utah ^[3].

A geofence built on IP addresses treats the address as the user's location ^[5]. Here is what users actually do: they route traffic through VPNs and proxy servers for privacy and security, and some use the same tools to get around IP-based restrictions ^[4].

"The law requires geolocation perfection, but the parties agree that current technological advancements do not allow an entity to perfectly (1) detect VPN/proxy users, or (2) geolocate where all of those VPN/proxy users are accessing the site from," the court wrote ^[7]. The rest follows in a few steps. The court found a site would be in violation "if even one of those users happened to be obfuscating" their location ^[14]. Aylo argued it would therefore have to "impose age verification on every user of their platforms, everywhere in the world" ^[11]. The court agreed that "Aylo could not ensure compliance with the law without age-verifying all users" ^[12]. A Utah law that sets the rule for visitors from every other state is what brought the dormant Commerce Clause into play ^[8].

That doctrine is meant to limit how far states can regulate commerce crossing state lines, and Techdirt notes it had mostly been an extra throw-in argument in earlier cases over state internet laws ^[13]. Here the injunction rests on it ^[8].

Techdirt calls the holding very narrow ^[8]. The judge contrasted the provision with "a law that merely increases a company's cost of running its business" ^[10]. On that reasoning, a state that demands an expensive check on users a site can identify is a different case ^[10].

By one estimate Techdirt cites, more than 300 state bills on social media and kid safety were introduced in 2025 alone ^[15]. Compliance teams cannot litigate each one, so they need a way to sort them.

I'd sort each bill on two questions. The first is whether the trigger is something a site's systems can observe, such as an IP address or a billing address. The alternative is a fact about the person the site cannot see, such as where they physically are. The second question is whether one undetectable user puts the site in violation.

Where the trigger is observable and a stray error is tolerated, a geofence with its gaps written down is the answer. A good-faith standard on an unobservable trigger gets the same treatment. Zero tolerance on an observable trigger can still be met inside the state, at a price, and the Utah reasoning does not reach price ^[10]. Zero tolerance on a trigger the site cannot observe is the Utah fact pattern, where the only safe setting is global ^[12].

I'd keep IP geofencing as the default and put strict "actually located" language in its own category for counsel. The tradeoff is that the ruling helps only in that last cell, and it is a preliminary injunction from a single federal judge ^[1].