- Aylo, the owner of PornHub, sued Utah last month to stop an age verification law from going into effect.
- SB73 would make porn platforms liable for making a reasonable effort to verify that users are not minors.
- Aylo argues the law is impossible to implement and unconstitutional because it applies to users with VPNs.
One of the largest distributors of online pornography in the world, Aylo, sued Utah last month to stop the enforcement of an expanded porn website age verification law — the toughest in the country.
The owner of Pornhub, RedTube and YouPorn alleged that the law — which passed nearly unanimously in the Utah Legislature — violated constitutional restrictions on states legislating outside of their own borders.
State Sen. Calvin Musselman, R-West Haven, who sponsored SB73, said the law simply applies age-based safeguards already used for alcohol, tobacco, gambling and gaming industries to today’s digital environment.
“Protecting kids while preserving freedom is not a new concept,” Musselman told the Deseret News in a statement. “SB73 is about accountability, requiring companies that profit from material harmful to minors to take reasonable steps to help prevent access by children.”
The law would require porn websites to have users complete an age verification process or to confirm from which state they are accessing the site. This approach aims to balance user privacy and restricted access to age-inappropriate content, Musselman said.
In 2023, Utah became one of the first states to require porn companies to verify the age of users. SB73 builds on this precedent with a new enforcement mechanism in addition to private lawsuits and a 2% excise tax for online pornography to fund enforcement.
Emboldened by a U.S. Supreme Court ruling in June 2025 that upheld a state-enforced age verification law in Texas, Utah lawmakers empowered the Department of Commerce to penalize companies that fail to block minors from accessing their content.
Utah’s law goes beyond the age verification laws passed in two dozen other states by clarifying that an individual will be considered to have accessed a porn website from within the state even if they are using a virtual private network, or VPN.
What is a VPN?
VPNs hide the IP address of a device so that websites cannot directly track its browsing history or location. They are advertised as a tool to increase privacy. But they also make it harder to implement policies for all internet users in an area.
Instead of applying an age verification system only to Utah IP addresses, or simply blocking website access for Utah IP addresses — which Aylo has done for the past three years — Aylo would now be required to ensure no underage Utahns are accessing their sites with a VPN.
Aylo asked a federal district judge to declare Utah’s law illegal and to block its enforcement because it allegedly would require Aylo to verify the ages or locations for all of its users around the globe to account for the potential use of VPNs by Utahns.
This would effectively make Utah’s regulation on porn websites the law of the land in America and around the world, according to the complaint. Aylo alleges that this would violate the U.S. Constitution’s clauses on interstate and foreign commerce.
Aylo claims that SB73’s “Deemed-Location Provision” puts them in “an impossible position” — forcing them to drive away up to 80% of customers who in other states have opted to use a different platform rather than verify their age, or pay stiff fines of up to $2,500 per violation.
“The Deemed-Location Provision thus transforms what is nominally a Utah regulation into a de facto global mandate,” the complaint reads. “No state has ever before enacted this type of Deemed-Location Provision. Nor has any state attempted to give its age-verification framework such sweeping global coverage.”
However, Utah is not the first jurisdiction on the world stage to put the responsibility on adult websites to keep children off: The United Kingdom and Australia have both passed sweeping laws requiring websites or apps to restrict access based on user ages.
Why don’t porn companies verify age already?
Aylo is ignoring the many ways websites already triangulate the rough location of internet users, including those with VPNs, by monitoring time zones and advertising data, according to Iain Corby, executive director of the Age Verification Providers Association.
Modern technology has eliminated the trade off between age verification and privacy, Corby said. The companies he represents verify ages by reviewing government IDs, emails, facial recognition or even the way an individual moves their hand before automatically deleting the review.
Corby has consulted with every state to have passed porn site age verifications, he said. He plans to work with Utah regulators to determine their rule for what counts for a company to avoid liability by making a reasonable effort to block access to minors.
Corby told the Deseret News he is confident Utah will succeed against Aylo. But by focusing on legal technicalities, court battles often hide the biggest unanswered question, according to Corby: Why have porn companies not taken it upon themselves to restrict access to minors already?
“I’m surprised that Aylo doesn’t want to keep children off its website globally, and is restricting its concerns to people in Utah,” Corby said. “I think it would be a good thing if all adult websites apply data verification globally and then we wouldn’t even have this problem in the first place.”
On May 6, most provisions of SB73 went into effect, including the 2% porn “sin tax.” Most revenues will be used for mental health treatment, outreach and educational programs related to harmful online material for minors. The rest will be used to pay for enforcement.
The Utah Department of Commerce and Aylo agreed on April 27 that while the lawsuit works its way through the courts the state will delay enforcement of the provisions that create liability for not verifying the age and location of internet users with a VPN until Sept. 3.