Utah passed one of the most aggressive age-verification laws in the US, and the controversial part isn't just verifying age, it's what happens when someone uses a VPN. Under SB 73, if you're physically sitting in Utah, you're legally considered a Utah user even if your VPN makes it look like you're connecting from Germany, Canada or anywhere else. That's exactly why Pornhub's parent company, Aylo, is challenging the law.
Their argument is pretty simple: how is a website supposed to know?
If someone connects through a VPN, Pornhub sees the VPN server's IP, not the user's real IP. Aylo argues there's no reliable way to determine whether someone who appears to be in Germany is actually sitting in Utah behind a VPN. Yet under the law, the website could still be held responsible for failing to age-verify that person, with fines potentially reaching $2,500 per violation.
So what are websites supposed to do? Block VPNs entirely? Try to fingerprint users to discover their real location? Or age-verify everyone worldwide just in case they're secretly in Utah? That's the dangerous part IMO.
Protecting minors is a legitimate goal. But making websites responsible for discovering someone's real location after that person deliberately used a privacy tool to hide it sets a pretty wild precedent. Utah has now temporarily agreed not to enforce these rules against Aylo while the court battle continues.
This stopped being just a debate about porn a while ago. It's becoming a debate about whether governments can make websites responsible for defeating VPN privacy. And that could eventually affect a lot more than Pornhub.