Utah's VPN-related location provision and US site-blocking bills

On 24 September the federal district court in Utah issued a preliminary injunction, an order pausing a law while the case continues, against a state provision on where users are actually located. The provision required adult websites to treat users who are physically in Utah as accessing from Utah even when they connect through a VPN. The same month, two site-blocking bills were introduced in the US Congress. One (H.R. 10364) lists VPN providers among the services a court can order to block access, while the other (the DEFEND IP Act) expressly excludes providers that only offer VPN services.

Utah's provision is aimed at users in Utah, though the court found that in practice sites might have to age-verify every user. The federal bills cover users in the United States. As of 7 October the lawsuit is ongoing, and both bills were referred to the Judiciary Committees after being introduced in September.

Utah has required age verification since 2023 for businesses whose websites consist of more than one third material harmful to minors. S.B. 73 (Online Age Verification Amendments), passed in March, added two VPN-related provisions that took effect on 6 May. One says a user physically in Utah is accessing from Utah regardless of a VPN or proxy. The other bars these sites from facilitating or encouraging the use of a VPN to get around age verification, for example by giving instructions, and the law places no duty on VPN providers themselves.

Aylo, which runs adult sites including Pornhub, challenged only the location provision, and that is the only part the injunction covers. Its complaint says it does not object in principle to age verification if it is technically feasible, enforced evenly and protective of privacy. The court wrote that both sides agree no website can determine every user's location perfectly, and that the provision contains no word like "reasonable", so it in effect demands perfection. To avoid liability a site would have to age-verify users everywhere, so the court found the provision likely violates the dormant Commerce Clause, the constitutional principle that limits state laws from unduly burdening commerce outside the state.

Both federal bills let copyright owners ask a court to designate a foreign piracy site, then seek an order requiring service providers to stop users in the United States from reaching it. H.R. 10364, the American Copyright Protection Act, introduced on 14 September, covers broadband providers, DNS services and VPNs, except those with fewer than 100,000 monthly US users. The DEFEND IP Act (H.R. 10575, with a Senate companion S. 5529), introduced on 24 September, covers broadband providers with at least 50,000 subscribers and public DNS services with annual revenue over $100 million. It excludes providers that offer only VPN services or only encrypted DNS.

Perspective

A VPN sends a user's traffic through the VPN provider's server, so the website sees the server's IP address. According to the ruling, both sides agree every method of locating users both misses some and wrongly flags others, and can be manipulated. Commercial VPN detection services exist, and the parties' experts disagree about how reliable they are while agreeing they help to some degree.

On locating users, Utah's brief opposing the injunction says the state has a substantial interest in protecting minors from online pornography. According to KSL, the bill's sponsor said after the ruling that VPNs are clearly a way around age verification. The state also argued that VPN detection and geolocation are inexpensive and common, citing the online gambling industry, and that sites can comply without age-verifying the whole world.

Utah's consumer protection division has also proposed a rule requiring sites to tell whether a person is in Utah with at least 95% accuracy, which the court did not consider. In comments on that draft rule, EFF wrote that connection latency varies with ordinary network conditions and device time zones are easy to change, so websites cannot reliably tell whether a VPN connection comes from Salt Lake City, Seattle or Shanghai. The court held that the text demands perfection, adding that Utah's argument for a reasonableness standard concedes there are less burdensome ways to serve its interest. The ruling also recognised protecting minors as a substantial state interest.

The two bills take opposite approaches on whether VPNs can be ordered to block sites. ITIF, which endorses the DEFEND IP Act, wrote that the bills differ in technicalities, notably in how they treat VPNs and DNS providers, and that both are a significant step forward for rightsholders. Neither sponsor's press release mentions VPNs. EFF wrote that the 2025 Foreign Anti-Digital Piracy Act (FADPA, H.R. 791) excluded VPN-only providers and that H.R. 10364 drops that exclusion.

On procedure, EFF wrote that a site can be designated under H.R. 10364 without appearing in court. The sponsor's press release says courts must consider technical feasibility and unintended harm, and that affected parties can contest or seek to modify orders. EFF wrote that the DEFEND IP Act has no penalty for seeking a block in bad faith, while its sponsors' release says every blocking order goes through a US court and no specific technical measure is mandated. Comparing the texts, we note that the DEFEND IP Act also lets a court issue a designation order without waiting for the site operator to appear.

On effectiveness, the Motion Picture Association points to the United Kingdom and Australia, where it says similar policies have worked well for more than a decade. EFF cites Italy, where 510 legitimate sites that offered no streaming were blocked, and Spain, where more than 550,000 domains were blocked during football broadcasts. EFF's figures come from a chart by the Re:Create coalition that we could not retrieve. ITIF wrote that at least 50 countries allow blocking foreign piracy sites and that critics cite mismanaged cases in Italy and Spain while leaving out successes such as Canada and the United Kingdom.

Several places in Asia have different frameworks for court or government blocking. Singapore has let courts order network service providers to block "flagrantly infringing online locations" since 2014. Under section 325 of its Copyright Act 2021 the High Court must weigh the burden on the provider, technical feasibility and whether a less burdensome order would work as well. The sections we read do not mention VPNs.

In India, the Delhi High Court created "dynamic injunctions" in a 2019 piracy case, letting rightsholders add mirror sites through the court registrar without filing a new suit, and noted that India has no statutory procedure like Singapore's. Under April 2022 directions from CERT-In, India's national computer emergency response team, VPN providers must record validated subscriber names, assigned IP addresses and the purpose of use, among other details, and keep them for five years after registration ends.

In Japan, an April 2018 government emergency-measures proposal considered voluntary blocking of three named piracy sites by private providers appropriate. An August 2026 government roadmap, attaching a countermeasures menu last updated in May 2024, says blocking legislation remains under consideration. We did not check Japan's rules on VPNs.

As of 7 October, people outside the US do not need to change how they use VPNs because of either development, and neither do people in the US, since Utah's provision is paused and neither bill has passed. An injunction is temporary, and based on the ruling, we infer that if the provision is enforced, users outside the US could also be asked to verify their age on these sites. Under Utah law, verification can use a digital ID, a third-party service checking personal data or transaction records, and the site may not keep identifying data afterwards.

Based on the text of H.R. 10364, we infer that if it passes, VPN providers with 100,000 or more monthly US users could be ordered to stop US users reaching specific sites. The text covers users in the United States and says nothing about users elsewhere.

When reading future bills that require sites to locate users or order providers to block sites, a few questions help. How accurate must the location be, and who bears the cost of mistakes: the site, the VPN or network provider, or the user? What would users have to hand over to prove they are elsewhere, and would they have to turn off their VPN? What process does a blocking order go through, how can a wrongly blocked site appeal or seek compensation, and does the approach achieve its goal, such as keeping minors from adult content or moving traffic to legal services?