A privacy tool built for reporters and dissidents has become the default reply to a stack of age-check laws aimed at pornography. The signup spikes were the first chapter. The second is a fight over whether a state can treat a masked connection as if the mask were not there. On September 24, 2026, a federal judge in Utah said no, at least for now, and blocked the piece of a state law that tried to age-verify people who were routing their traffic through a virtual private network.
That ruling did not repeal age checks. It drew a line around them. Adult sites in Utah still have to screen visitors the law can actually locate. What U.S. District Judge David Barlow refused to let the state enforce was Utah Code section 78B-3-1002(3), the “actual location” provision of Senate Bill 73. Aylo, the company that owns Pornhub, sued the Utah Division of Consumer Protection and argued that perfect geolocation does not exist. Barlow agreed the provision was likely to violate the Constitution’s dormant Commerce Clause, that the harm was irreparable, and that the balance of equities favored an injunction. The rest of Utah’s age-verification statute, sections 78B-3-1001 through 1008, stayed in force. The Free Speech Coalition called it an early win against a law that would have pushed identity checks past any border a VPN can cross.
The injunction landed almost exactly a year after the policy that made VPNs a household argument in Britain, and more than a year after the U.S. Supreme Court told states they could demand proof of age before an adult opened a legal website. On June 27, 2025, the Court decided Free Speech Coalition, Inc. v. Paxton by a 6–3 vote and upheld Texas House Bill 1181. The statute covers commercial sites on which more than one-third of the content is sexual material harmful to minors, and it requires those sites to verify that a visitor is 18 or older using a government ID or transactional data. Justice Clarence Thomas’s majority applied intermediate scrutiny and held that adults have no First Amendment right to avoid an age check when the underlying material can be kept from children. The dissenters, and groups including the ACLU and the Electronic Frontier Foundation, warned that the decision walked away from older cases that had treated ID gates as a burden on lawful adult speech. The opinion is now the map every statehouse lawyer is using.
Louisiana had gone first, with Act 440 taking effect in January 2023. Utah, Mississippi, Virginia, Arkansas, and Texas followed that year. By September 2026, privacy trackers counted 27 states with some version of an adult-site age-verification rule on the books, among them Alabama, Arizona, Florida, Georgia, Indiana, Kansas, Kentucky, Missouri, North Carolina, Ohio, Oklahoma, South Carolina, Tennessee, Virginia, West Virginia, and Wyoming. Missouri’s statute took effect on August 28, 2026. Iowa’s arrived in July. West Virginia’s in June. Rather than build a verification system in every jurisdiction, Aylo geo-blocked Pornhub across a long list of those states. A lawful site in one ZIP code became a dead end in the next, and the workaround was obvious to anyone who had ever used a VPN to watch a sports blackout.
The British version of the same idea produced the cleanest set of numbers. The Online Safety Act’s child-safety duties for pornography took effect on July 25, 2025. Services had to deploy what the regulator Ofcom calls highly effective age assurance: photo identification matched to a face, facial age estimation, a credit-card check, or something in that family. Fines can reach 18 million pounds or 10 percent of worldwide revenue. Proton said UK sign-ups for its VPN jumped more than 1,400 percent as the deadline passed and then held at roughly 1,800 percent above the old baseline in the days that followed. VPN apps climbed the UK App Store charts. Traffic did not politely stay inside the new gate.
Ofcom’s first statutory age-assurance report, published in July 2026, showed the surge was not a weekend fad. The Financial Times, citing the regulator, reported an estimated 2.2 million daily VPN users in the UK, up from 1.2 million before the rules. Estimated daily visits to pornography sites fell by about a third. All ten of the country’s most visited porn sites, and a majority of the top 100, now run checks. Across a sample of 32 regulated services, more than 69 million age checks were completed between July and December 2025, a 23-fold increase on the prior six months. The share of children who, when asked to prove their age, encountered a highly effective method rose from 25 percent in July 2025 to 43 percent by January 2026. Ofcom also found that about a quarter of children had used a VPN. A law written to keep minors out had taught a measurable slice of them how to look like they were browsing from somewhere else.
Technology Secretary Liz Kendall told Parliament, in remarks reported as the Ofcom study landed, that the government would not age-gate or ban VPNs, and that platforms were expected to detect and block circumvention themselves. That is a different bet from Utah’s. Britain is leaving the privacy tool legal and telling websites to notice when someone is using it. Utah tried to write the VPN out of the legal fiction of location, then watched a judge freeze that sentence. Adults using a VPN to reach a site that is legal for adults are not, on the current UK rules, committing an offense. Platforms are barred from promoting the workaround. Ofcom has already shown it will fine companies that simply skip the check: Youngtek Solutions was penalized 500,000 pounds for running sites without highly effective age assurance from July 25 through September 22, 2025.
The privacy objection is not abstract. An age gate that asks for a driver’s license or a face scan creates a database that links a real identity to a visit an adult would rather not have sitting on a server. Breach history in the identity business is long, and a porn-site login paired with a government ID is a blackmail file waiting for the wrong contractor. Critics at the Center for Democracy and Technology argued in the Texas case that forcing identification ends the anonymity the First Amendment has protected for controversial reading. Civil liberties groups have also warned that “harmful to minors” can be stretched, in the wrong legislature, toward sexual-health material and toward LGBTQ creators whose work is not pornography at all. The Supreme Court did not adopt that warning. It did leave the definition fight for later cases.
Europe is trying a third design. The European Union has been piloting a white-label age-verification app tied to digital identity wallets, built so a site receives an “over 18” answer and not the underlying document, using zero-knowledge proofs. If it works at scale, it answers the data-hoarding objection that American ID checks ignore. It does not answer the child with a parent’s phone, or the adult who refuses to enroll a face in any system, public or private. Those people are the demand curve behind the VPN business.
Samir Jain of the Center for Democracy and Technology has argued for years that criminalizing VPNs would be both ineffective and constitutionally fragile. The Utah order is the first major American illustration. A state can punish a website that serves sexual material to a minor it can identify. It cannot, on this preliminary reading, conscript every encrypted tunnel on earth into a Utah census. Proton, Mozilla, Mullvad, the Tor Project, and the Electronic Frontier Foundation have said in joint statements that restricting VPNs would make ordinary people less safe, not more, because the same software hides journalists, domestic-violence survivors, and dissidents. The Tech News file at The AEGIS Alliance has tracked that tension whenever a security tool gets drafted into a culture-war statute.
What the numbers describe is a substitution effect, not a solved problem. Where the big platforms block a state, visitors leave for smaller sites that have not hired a compliance vendor, or they leave for a server in a state without a statute. Where the platforms comply, a share of adults comply too, and a share route around the prompt. Ofcom’s own charts show both things at once: many more completed age checks, and many more VPN sessions. The policy can be judged only if both lines are kept on the same graph.
The next cases will test how far Barlow’s commerce-clause logic travels. Other states have copied Texas on the ID requirement. Few have copied Utah’s attempt to pierce VPNs. If more do, Aylo and the speech coalitions already have a memorandum they can paste into the next complaint. If they do not, the American map stays a patchwork, the British experiment stays a live measurement of circumvention, and the VPN industry keeps the most reliable marketing campaign it never had to buy.
Readers who want the security side of the same story can start with how Google dismantled a shadow network that quietly used phones as internet relays, and with the keystroke-stealing flaws that show why an identity database attached to adult browsing is not a theoretical risk. The statute books moved. The packets found another road.
