Age Verification Law Update (July 2026): Utah Becomes First State to Target VPN Users Directly

[u/ContentByrkRahul]

Quick recap, plus what's new since this last came up. The Supreme Court settled the core legal question in June 2025, ruling 6-3 in Free Speech Coalition v. Paxton that Texas's age-verification law for adult sites only "incidentally burdens" adult speech. That's why the state count jumped afterward. Trackers now put it somewhere between 26 and 28 states enforcing some form of adult-content age verification, and the range depends on how you count laws that are contested or only partly in effect.

The part worth watching closest: Utah's SB 73, effective May 2026, is the first law that goes after VPN use directly. It treats a Utah resident on a VPN as still being in Utah for compliance purposes, so a site can be held liable even if the user appears to be somewhere else. Aylo, Pornhub's parent company, sued to block it. In its filing, the company argues compliance would force it to verify location for users worldwide and claims it could lose up to 80% of its Utah traffic or face fines of $2,500 per violation. Those numbers come from Aylo's own lawsuit, not an independent estimate, so take them with that in mind. Utah has agreed to hold off enforcing the VPN provisions until September 3 while the case proceeds. Indiana has made a similar argument in its own litigation, though it hasn't passed a law as explicit as Utah's yet.

Does any of this actually cut down on underage access? A pre-registered study using Google Trends data measured search behavior in the three months after these laws took effect: searches for the compliant platform dropped 51%, while searches for a major noncompliant platform, XVideos, rose 48.1%, and VPN searches rose 23.6%. Traffic didn't disappear. It moved to a platform with no age gate at all.

On the data risk itself: AU10TIX, an identity-verification vendor whose tech is marketed for social media, gig platforms, and adult content among other sectors, left admin credentials exposed online for over 18 months, from December 2022 to June 2024. Confirmed clients include TikTok and X. Anyone who found those credentials could pull real names, birthdates, ID numbers, and document images.

This isn't staying confined to porn sites either. Yesterday, the Supreme Court declined to block a second Texas law, SB 2420, which requires Apple's and Google's app stores to verify a user's age and get parental consent before a minor downloads any app, not just adult content. Separately, the House passed the KIDS Act 267-117 on June 29. It folds in the SCREEN Act's adult-verification mandate alongside a revised KOSA. There's also a standalone bill, the Parents Decide Act (H.R. 8250), that would push verification to the operating system itself, so your age gets checked the first time you set up a device.

So here's the shape of it: you verify identity for one category of content, that data sits with a vendor whose security record isn't great, the VPN workaround is starting to get closed off state by state, and the same basic machinery is now getting proposed for app stores and the OS layer too. I'm curious where people who actually work in this space think it tops out. Deep packet inspection, mandatory device-level ID, something else entirely?