A state can police its own pavements; policing the internet is harder when somebody’s pocket computer claims to be in Reykjavík. Utah’s age-verification law ran into that problem on September 24th, when David Barlow, a federal district judge, enjoined what he called its “actual-location provision” while a challenge proceeds. The rest of the statute remains in force, so this is a partial victory rather than a rout.

The provision sits in Utah Code 78B-3-1002. It treats a person as accessing a site from Utah if actually located there, even when using a virtual private network, proxy server or other means of disguise. The practical demand was therefore not merely to check Utahns. As Judge Barlow put it, the clause “in practice requires an entity to perform age verification services for every user visiting its site from any location,” because one masked visitor might be enough to break the law.

there is no way for a website operator to determine a user’s physical location with perfect certainty

The plaintiffs are Aylo Freesites Ltd and Aylo Group Ltd, operators of free adult sites. Aylo sued on April 22nd 2026; Utah twice agreed not to enforce against the company, with the second truce lasting until the injunction. Aylo argued that compliance meant imposing checks on users “everywhere in the world”, or else guessing physical location from device signals such as time zone, language and currency settings.

Judge Barlow’s route was the dormant Commerce Clause, not a broader ban on extraterritorial legislation, which he rejected; he declined to reach a Foreign Commerce Clause argument. The decisive test was Pike balancing: whether a burden on interstate commerce is “clearly excessive in relation to the putative local benefits.” The provision, he noted, “does not contain the word ‘reasonable’”, leaving no safe harbour for good-faith geolocation.

A court does not ‘uphold an unconstitutional statute merely because the Government promised to use it responsibly’

The defendants are the Utah Division of Consumer Protection and its director, Katie Hass, plus the Utah Department of Commerce and Margaret Busse, its executive director. The surviving law lets sites verify age through digital ID, commercial databases regularly used by government agencies and businesses, or transactional records tied to mortgages, education and employment. It also forbids websites from telling users how to reach them through VPNs, a clause that stubbornly remains.

Reclaim the Net, which reported the ruling, sees age-gating as censorship in waiting and harvests of sensitive data. That is an advocacy view, but the court’s narrower point is enough: if legality depends on piercing every disguise, a local rule becomes global by default. States may still write age laws; they cannot quietly draft the whole earth as Utah.