A federal judge in Utah has blocked SB 73, a state law that would have required adult websites to stop anyone from reaching them through a VPN. Signed into law earlier this year, it made Utah the first state in the country to treat VPN use itself as the thing to regulate, telling adult platforms to either detect and block visitors hiding behind one or identify where each visitor physically was. It even barred sites from explaining how a VPN could get around the check. Aylo, the parent company of Pornhub, sued in the spring, and the court has now halted enforcement of the law’s VPN provisions, agreeing with the argument the Electronic Frontier Foundation had been making all along: the statute demanded something no one can actually build.
The conflict was never really about whether minors should see adult content. It was about whether a website can know where a visitor is. When traffic leaves a VPN server, the destination site sees only that server’s IP address; it cannot tell whether the connection originates in Salt Lake City, Seattle, or Shanghai. The court put the impossibility in one line: “geolocation perfection is not presently possible.” Because the law would have held sites strictly liable if even a single Utah user slipped through unnoticed, the honest reading, as Judge Barlow wrote, is that a platform like Aylo would have to run age verification on every visitor in the world, just in case. That leaves two options, and both are absurd: block all VPN traffic nationwide, or pull out of Utah entirely.
The Hacker News thread, which reached 551 points and 240 comments, spent most of its energy in the same gray zone the ruling exposed. Can you reliably tell a VPN connection at all? People listed the heuristics already in use: known datacenter IP ranges, packet sizes, response timing measured against a ping, browser fingerprints, reputation scores that climb when a hundred users appear from one address. None of them are certain, and each one makes mistakes. A connection through a friend’s house, a self-hosted WireGuard box, or a residential proxy looks like an ordinary person, because it is one. One commenter summed up the arms race from the user’s side: the harder the block, the more people pay extra for residential proxies, and the less the block knows about who it just turned away.
🎩 Cask’s Take
The ruling is narrower than the headline makes it sound, and that is exactly what makes it worth reading. Judge Barlow did not say Utah cannot restrict adult content or require age checks. He said Utah cannot order websites to do something the network will not let them do. That distinction matters, because it is the rare case where a court looked past a law’s intent and asked whether the mechanism existed at all. Legislatures have grown very comfortable writing rules for a version of the internet that has a front door, a doorman, and a guest list. This one asked for the guest list.
The best part of the thread is a question one commenter raised about the old truism that the internet always routes around censorship. Is that still true, or has it quietly become a line we repeat because it used to be? The mechanism still works. A WireGuard box in a friend’s house defeats any protocol-level test, and no amount of traffic analysis resolves a connection that genuinely is an ordinary household. But the mechanism has always depended on people who know how to use it, and these laws are not aimed at them. They are aimed at the ninety percent who do not, and the goal is not a perfect block but a credible risk of detection. You do not have to catch every VPN user to change behavior; you only have to make enough people afraid to bother.
That is why the win is real but fragile. SB 73 died because it demanded perfection, and “technically impossible” is the kind of defense that evaporates the moment detection gets ten percent better or a legislature writes a statute that asks for a good-enough guess instead. The precedent worth watching is not that one state lost. It is that American states are now legislating at the layer where the internet is actually built, and they are importing a playbook that used to belong to a very different set of governments.
So the day’s story is not that Utah was wrong about the internet. It is that the internet was never shaped to answer this kind of question, and a law only failed here because someone finally made it say so out loud. The next one will ask for less than perfection. Perfection was never the point.