Over the last few years, with Congress completely incompetent and a massive moral panic about tech raging, states have stepped up to try to regulate the internet any way they can. Even after the Supreme Court reminded states that the First Amendment still exists online and their varied attempts to regulate speech faced serious constitutional hurdles, it hasn’t cooled state legislators’ and governors’ enthusiasm for pushing through a patchwork of confusing (and sometimes conflicting) laws. And of course, with the Supreme Court’s prudish ruling in Free Speech Coalition v. Paxton, the Court seemed to say states could ignore the First Amendment so long as they shouted “porn!” and “children!” in proximity to each other.
One estimate says that over 300 state bills to regulate social media and kid safety on the internet were introduced in 2025 alone. And, from the beginning, some of us have wondered how states could even try to regulate the internet at all, given that the dormant Commerce Clause (DCC) is (in theory) supposed to limit the states’ ability to regulate commerce that runs across state lines, as the internet obviously does. While the DCC has come up in a few cases, it’s mostly been as an extra throw-in and given significantly less attention than other arguments.
So, it’s good, if somewhat surprising, to see that a federal judge in Utah has blocked a key piece of that state’s latest (in a long line) attempt to age verify parts of the internet. Utah already required adult content sites to age verify Utah users back in 2023. This year’s amendment added a provision saying that anyone “actually located” in Utah counts, VPN or no VPN. Aylo, the internet’s largest adult content company, sued to block that new provision. And, so far it has worked, with the court granting a preliminary injunction against that provision. But what’s most interesting is that the ruling relies on the dormant Commerce Clause, though in a very narrow way.
The new law was crazy in all sorts of ways, effectively demanding that websites see through VPN usage to figure out where a person really is, even if they appear to be somewhere else. Even Utah agreed that this isn’t something anyone can actually do with certainty:
However, all the parties agree that IP-based geolocation is underinclusive because it fails to account for technologies that obscure a user’s location. These technologies, including virtual private networks (“VPNs”) and proxy servers, mask a user’s true location by routing traffic through IP addresses corresponding to different geographic locations. VPNs and location-obfuscation technologies have entirely legitimate purposes—such as securing communications on public networks, preventing websites from harvesting personal data, and circumventing censorship by oppressive governments. But these technologies can also be used to circumvent IP-based geolocation restrictions, such as the one used by Aylo for its free sites. Utah presumably passed the actual-location provision to address this issue.
But both parties also agree that there is no way for a website operator to determine a user’s physical location with perfect certainty. Aylo argues that Utah’s actual location requirement means that Aylo must “impose age verification on every user of their platforms, everywhere in the world” because it is impossible to know for sure whether any given user actually is in Utah.
The court then rejects a bunch of Aylo’s other arguments before zeroing in on the one that lands: because Utah’s law demands perfect geolocation — an impossibility — the only way to comply is to age verify absolutely everyone, everywhere. That clearly impacts commerce far beyond Utah’s borders… and thus triggers the dormant Commerce Clause:
The law requires geolocation perfection, but the parties agree that current technological advancements do not allow an entity to perfectly (1) detect VPN/proxy users, or (2) geolocate where all of those VPN/proxy users are accessing the site from. Aylo could not ensure compliance with the law without age-verifying all users. Unlike a law that merely increases a company’s cost of running its business, the actual-location provision in practice requires an entity to perform age verification services for every user visiting its site from any location because the entity would violate the law if even one of those users happened to be obfuscating their location from Utah. As a result, the law “cannot effectively be limited” to primarily regulating those in Utah obfuscating their location “over the Internet because no such [technology to detect those users in every instance] exist[s].”
Because the actual-location provision, in most cases, directly regulates an entity’s interactions with those who have no connection to Utah, it likely creates too much direct regulation of wholly out-of-state conduct to be lawful under the dormant Commerce Clause.
The court also finds that the law fails the (recently weakened) Pike balancing test, burdening interstate commerce far out of proportion to its local benefits:
As an example, Aylo has approximately 28 million active visitors to its sites each month from the United States. Because the law requires perfection in the absence of perfect geolocation tools, Aylo would need to verify those 28 million users—whether located in Salt Lake City, Boston, New Orleans, Anchorage, or Honolulu—to ensure compliance and avoid liability. Indeed, every entity that hosts material applicable under the actual-location provision would need to age verify all of the entity’s users nationwide or inevitably violate the law. This reach is expansive and would involve massive numbers of wholly out-of-state interactions.
The ruling is fairly narrow, though, and the court more or less tells Utah how to fix it: by adding a reasonableness clause that gives Aylo (and any others under the law) some leeway in how they determine the location of visitors:
Utah argues that the actual-location provision is indirect because technology “allow[s] Aylo to reasonably and feasibly attempt to age assure VPN-using Utahns, [so] any decision by Aylo to instead age-verify all users would be a voluntary business choice, not an effect forced by Utah law.” The court does not doubt that this is the Attorney General’s good faith intention. But, as discussed above, the actual-location provision does not contain a reasonableness or feasibility standard and would therefore impose liability every time an entity did not perform age verification on a user located in Utah. Unlike Online Merchants Guild, the nationwide reach of the actual-location provision would not be due to an entity’s choice on how to structure its business. Rather, it would be “inevitable” that the entity would need to comply by age verifying every outside-of-Utah user on its site to avoid liability.
The court makes the same point again when it notes that there are “less burdensome means” to get what Utah says it wants:
Second, the significant local interests served by the actual-location provision can be achieved through less burdensome means. To be sure, the law involves a substantial safety interest in preventing minors from accessing harmful sexual material, which falls squarely within Utah’s traditional regulatory power. But Utah has represented that a law requiring “feasible and reasonable [geolocation] methods,” instead of perfection, would promote the same interests served by the actual-location provision. Because of this unique posture, Utah’s weighty interests could clearly be “promoted with . . . a lesser impact on interstate activities.” Thus, Aylo has shown that the actual-location provision likely imposes an excessive burden on interstate commerce in relation to its local benefits.
So, while it’s nice to see one of the many state internet regulations blocked on DCC grounds, it seems incredibly likely that Utah will just have its legislature rewrite the law (again), add a “reasonable” or “feasible” standard, and take another crack at it. While that would have the benefit of not requiring companies to do the literal impossible thing of seeing through VPNs to figure out where people really are, it won’t do much to stop yet another silly age verification law from existing.