Build1 publisher2 min readPublished
Judge Barlow halts Utah's SB73 because VPNs defeat the location check it demands
Judge Barlow blocked Utah's SB73 after finding sites cannot perfectly geolocate VPN users, a gap Aylo says covers all 28 million of its US users. The preliminary order turns on what a network connection can reveal, and document-based age checks are the compliance path that still works over a VPN.
The Engineer · Build desk
What happened
- SB73 told adult sites to block any visitor who appeared to use a VPN or similar tool, or else verify the age of every user in case one was physically in Utah.
- The order does not weigh whether SB73 is good policy; it addresses only whether a site can actually comply with it.
- Aylo, Pornhub's parent company, sued Utah, arguing the law cannot separate Utah users from the rest of its US audience because any of them might be on a VPN.
- Utah published the SB73 compliance rules, R152-78B, on September 1, 2026, and they were due to take effect on October 8.
- SB73 also barred sites from explaining how to use a VPN to get around it, a provision this suit did not challenge.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost Operators had 37 days to build to R152-78B; the order lifts that deadline for now, and the build work returns if Utah wins the case.
- precedent Challengers to other laws that gate access by location now have an argument one court has accepted: put the network's limits on the record and ask whether compliance is possible at all.
- constraint Utah can still pursue age checks, but a version built to survive this reasoning would need a trigger other than IP location, which pushes it toward document checks for everyone.
A website learns three things about an incoming connection: the source IP, packet metadata such as size, timing and port, and the content when it arrives unencrypted [3]. A VPN interferes with all of them. The visible IP becomes the VPN server's, much of the traffic pattern is evened out, and the content is encrypted between the device and that server [3].
WireGuard is the cleanest case to reason about. It encrypts each packet with ChaCha20-Poly1305 before the packet leaves the device, so neither the ISP nor the destination site can read it [4]. It does this on Curve25519, in a design of a few thousand lines of code [5]. I count that small core as careful engineering. OpenVPN is older, runs over TLS and costs more compute, and IPsec lives mostly in corporate networks and home routers [5]. Every one of them decrypts at the VPN server, which forwards the traffic under its own source IP [6]. To the site, the connection comes from the server, whatever country the user is actually in [6].
Detection does not close the gap either. According to the write-up, a site that correctly flags a VPN still learns nothing useful about the age or identity of the person behind it [7]. ID-document checks do work over a VPN, because they never consult the IP [8]. They cannot be pointed at one state, though, since the connection does not say who is in Utah. A site that wants to be certain it complies is left verifying every visitor it has [2]. Aylo built its suit on that burden [12].
The dev.to write-up frames the ruling as a court confirming what network engineers have known for years [17]. It says Barlow's finding that perfect geolocation is impossible changes the legal analysis of the burden SB73 places on interstate commerce [13][14]. The order is preliminary, and it suspends the compliance rules only while the litigation runs [16]. SB73 itself was signed in early 2026 with a May start date [9].
The evidence supports a narrow reading. One federal court in Utah accepted a technical-impossibility argument at the preliminary stage [13][16]. The write-up does not discuss how other courts have handled location-based rules. For the reasoning to carry over, I'd expect a second law to share two features: a duty scoped by where the user physically is, and a record showing the site can learn that only from the IP. A rule that demands document checks from every user, with no location trigger, would lack the first feature.
What to watch
- Whether Utah appeals the preliminary order or rewrites R152-78B around document checks that do not depend on IP location.
- Whether anyone challenges SB73's ban on explaining VPN workarounds, the provision Aylo's suit left alone.
- Whether operators fighting other states' location-scoped age laws cite Barlow's geolocation finding in their own filings.