Court in Utah: geolocation by IP is not accurate

On September 24, 2026, federal judge David Barlow in Utah suspended the part of law SB 73 that required websites to determine the actual location of visitors even when using a VPN or proxy. The court's main argument was almost engineering-like: perfect geolocation by IP does not currently exist, yet the law demanded exactly that. At the end of October, the British Ofcom is expected to release its recommendations on identifying VPNs. Below, we discuss what the court decided, how it differs from the UK's position, and what changes for those working with geo-dependent services, scraping, and proxies.

What the Utah Court Decided

The lawsuit was filed by Aylo (owner of Pornhub and other adult sites), case Aylo Freesites Ltd v. Utah, No. 2:26-cv-00340. One provision was under scrutiny: section 78B-3-1002(3), added by the 2026 amendments. It considered a visitor physically located in Utah to be a resident of the state, even if their location was concealed by a VPN or proxy. The website was held responsible for such a user.

The court issued a preliminary injunction. The main arguments were:

The provision lacks a "reasonable efforts" clause. Formally, the website is responsible for every missed user, meaning it must geolocate everyone without errors. Both parties agreed that perfect geolocation is impossible.
Burden on commerce outside the state. Since it is impossible to accurately distinguish a Utah resident behind a VPN from a resident of Seattle or Shanghai, the website would have to verify the age of all visitors worldwide. The decision cites a figure: Aylo would have to verify 28 million users. The court found that this likely violates the so-called "dormant" Commerce Clause of the U.S. Constitution.
The state has less burdensome ways to protect minors.

Utah argued that the law does not require perfection but reasonable measures: probable VPN usage can be detected, and location can be inferred from device settings and account activity. The court responded that it analyzes the text of the law passed by the legislature, not how the attorney general suggests it should be applied.

What Remains in Effect

The primary obligation for adult websites to verify age using "reasonable methods" remains in place.
The prohibition for such websites to disclose how to bypass verification through VPNs, which Aylo did not contest, also remains.
The rules for implementing R152-78B, published on September 1 and set to take effect on October 8, cannot be enforced while the court's injunction is in place.
The parties agreed to postpone the proceedings until the end of the Utah legislature session in 2027: the law is expected to be rewritten.

Context: Age verification laws for adult content have been enacted in 27 U.S. states (as of August 2026), but only Utah attempted to directly require websites to identify users behind VPNs. We discussed how this provision looked before the court and why it pushed websites to block IPs en masse in the article about the SCREEN Act and Utah SB 73.

Why IP Does Not Indicate Where a Person Is

The court's conclusion is technically correct and extends far beyond adult websites. IP geolocation is a probabilistic estimate based on a database, not a measurement. The website only sees the address from which the request originated. If traffic goes through a VPN or proxy, this is the address of an intermediate server or someone else's device.

Even without a VPN, accuracy is low. According to MaxMind (one of the largest geolocation databases), for the U.S., about 60% of IP addresses are correctly identified within a 50 km radius, another 33% are tied to a city but miss by more than 50 km, and for 7% there is no city-level data at all. The company specifically states that it does not guarantee future accuracy.

The error arises from several layers:

Linking blocks to the registration region. A provider may register a subnet in one city but distribute it to subscribers in another.
Mobile NAT. Cellular operators have many subscribers behind one public IP, and internet access often goes through a node in another region.
Corporate networks and clouds. An employee in Utah using an office VPN appears as a user from headquarters in California or from a data center.
Delay in updating databases. Subnets move between providers and countries, and databases take weeks to catch up.

Therefore, any demand for "accurate determination" runs into the physics of the network. The Utah court essentially became the first court to document this in a ruling regarding VPNs.

The UK Is Taking a Different Approach

In the UK, age verification under the Online Safety Act has been in effect since July 25, 2025, with fines reaching £18 million or 10% of global revenue. User reactions were immediate: registrations for Proton VPN from the UK surged by 1400% on the day the rules took effect, and the app briefly surpassed ChatGPT in the UK App Store.

The authorities' position is more cautious than that of the U.S.:

On July 15, 2026, Technology Minister Liz Kendall stated in Parliament that the government will not ban VPNs or impose age verification on them.
Ofcom explicitly states that the law does not grant it the authority to require VPN blocking.
In a report from July 2026, the regulator acknowledged that no age verification method completely eliminates circumvention and recommends a multi-layered approach involving app stores and device-level controls.
At the same time, Ofcom has been tasked to release recommendations by the end of October 2026 on what services can do to identify and prevent VPN usage.

This means the British model is not "geolocate perfectly under threat of fines," but rather "take reasonable measures." Industry analyses are already outlining a three-state scheme for services: user is definitely from the UK (apply requirements), definitely not from the UK (out of law), and "location cannot be verified" — a separate decision on risk, such as verifying age for everyone in this group.

How Websites Will Identify VPNs and Proxies

Neither the American court nor the British regulator negates that websites will continue to flag suspicious traffic. A typical set of signals includes:

Hosting ASN. Addresses from cloud and data center ranges (AWS, Hetzner, OVH, M247, and similar) are flagged first: ordinary home users do not come from them.
VPN server lists. Many VPNs publish their server addresses, and others can be easily gathered by connecting to the service.
User density on IP. Hundreds of different accounts from one address in a short time indicate an exit node.
Discrepancies. Time zone of the browser, system language, keyboard layout, payment card locale against the country of the IP.
Behavioral and account signals — exactly what Utah referenced in court.

It is important to note that all these methods provide probabilities, not proof. False positives are inevitable: corporate VPN users, mobile subscribers, travelers, and automated systems that require geo for business will all be affected.

What This Means for Businesses Working with Geo

The ruling pertains to adult websites, but the implications are broader. IP geolocation is used for pricing, content licensing, anti-fraud, ad verification, and monitoring search results. Here are several practical conclusions.

If You Are a Service Owner

Do not base compliance on a single geolocation database. Even without a VPN, one in three addresses in the U.S. may be linked to the wrong city. For decisions with legal implications, you need a record of what "reasonable measures" you have taken.
Include a third state of "unknown." A binary "our region / not our region" works poorly on mobile and corporate traffic.
Cross-check multiple sources. Different databases may vary on the same address. We compared IPQS, Scamalytics, IPinfo, and other checkers on real addresses.

If You Collect Data or Verify Ads by Region

Data center addresses will be blocked first. A wave of age verification laws and regulator recommendations is pushing websites to block hosting ASNs entirely. For tasks where you need to see the site through the eyes of a local user, residential proxies with country and city selection are suitable: the address belongs to a home provider in the desired region.
Mobile addresses are more resilient to blocks but less accurate for city identification. Due to the operator's NAT, the site sees one address for many subscribers, making it costly to block. If the region is important rather than the exact city, mobile proxies are a reliable option.
Check where your IP is listed in multiple databases. The site may be using a different database than your checker and see another region. Before large-scale data collection, run test queries and compare what local version the target site returns.
Keep the browser fingerprint consistent with the IP. Time zone, language, and locale should match the exit country: discrepancies are caught more often than the IP itself.

What’s Next

Upcoming events to watch for:

End of October 2026 — Ofcom's recommendations on identifying VPNs. The main question is whether they will include specific technical methods or stick to the formula of "reasonable measures."
Utah Legislature Session 2027 — The law will likely be rewritten with a clause on reasonable efforts. The dispute will then shift from "can perfection be demanded" to "what is considered reasonable."
Other states — EFF has already stated it will contest similar initiatives, but age verification laws continue to expand to social networks.

Conclusion

The court in Utah affirmed what network engineers have long known: IP is a hint about location, not proof of it. Legislators can require websites to take reasonable measures, but not perfect geolocation. For businesses, this means two things. Service owners should build geo-logic with a margin for error and a third state of "unknown." And those who need honest access to local search results will have to monitor address quality even more closely: under regulatory pressure, websites will more frequently block data centers and prioritize residential and mobile IPs.