Opinion · District Court, D. Utah
Aylos Freesites Ltd, Aylos Group Ltd v. Utah Division of Consumer Protection, Katie Hass, in her official capacity as Director of the Utah Division of Consumer Protection, Utah Department of Commerce, Margaret Busse, in her official capacity as Executive Director of the Utah Department of Commerce
Aylos Freesites Ltd, Aylos Grp. Ltd v. Utah Div. of Consumer Prot., Katie Hass, in her Off. capacity as Dir. of the Utah Div. of Consumer Prot., Utah Dep’t of Commerce, Margaret Busse, in her Off. capacity as Exec. Dir. of the Utah Dep’t of Commerce, No. 2:26-cv-00340, UP11451083 (District Court, D. Utah Sept. 24, 2026)
- Type
- Opinion
- Court
- District Court, D. Utah
- Jurisdiction
- Utah
- Date
- 2026-09-24
- Topic
- bankruptcy
UNITED STATES DISTRICT COURT DISTRICT OF UTAH AYLO FREESITES LTD, AYLO GROUP LTD, Plaintiffs, MEMORANDUM DECISION AND ORDER GRANTING [ECF NO. 3] v. PLAINTIFF’S MOTION FOR A PRELIMINARY INJUNCTION UTAH DIVISION OF CONSUMER PROTECTION, KATIE HASS, in her Case No. 2:26-cv-00340-DBB-JCB official capacity as Director of the Utah Division of Consumer Protection, UTAH District Judge David Barlow DEPARTMENT OF COMMERCE, MARGARET BUSSE, in her official capacity as Executive Director of the Utah Department of Commerce, Defendants. Plaintiffs operate several free adult-entertainment platforms. Under Utah law, Plaintiffs and other adult-content providers must use “reasonable age verification methods to verify the age of an individual attempting to access the material.” At issue here, Utah recently amended its statute to specify that the age verification requirements apply if the user is “actually located” in Utah regardless of whether the individual is using technologies that make it appear that the user is accessing the platform from another state or country. Plaintiffs seek a preliminary injunction preventing Utah’s recent amendment from going into effect.1 Plaintiffs assert that, because it is impossible to know with certainty where a user is physically located, this amendment requires it 1 Pls.’ Mot. for a Prelim.
Citator
UpLaw has not yet analyzed Aylos Freesites Ltd, Aylos Group Ltd v. Utah Division of Consumer Protection, Katie Hass, in her official capacity as Director of the Utah Division of Consumer Protection, Utah Department of Commerce, Margaret Busse, in her official capacity as Executive Director of the Utah Department of Commerce. The absence of a flag is not a finding that it is good law.
UNITED STATES DISTRICT COURT
DISTRICT OF UTAH
AYLO FREESITES LTD, AYLO GROUP
LTD,
Plaintiffs, MEMORANDUM DECISION AND
ORDER GRANTING [ECF NO. 3]
v. PLAINTIFF’S MOTION FOR A
PRELIMINARY INJUNCTION
UTAH DIVISION OF CONSUMER
PROTECTION, KATIE HASS, in her Case No. 2:26-cv-00340-DBB-JCB
official capacity as Director of the Utah
Division of Consumer Protection, UTAH District Judge David Barlow
DEPARTMENT OF COMMERCE,
MARGARET BUSSE, in her official
capacity as Executive Director of the Utah
Department of Commerce,
Defendants.
Plaintiffs operate several free adult-entertainment platforms. Under Utah law, Plaintiffs
and other adult-content providers must use “reasonable age verification methods to verify the age
of an individual attempting to access the material.” At issue here, Utah recently amended its
statute to specify that the age verification requirements apply if the user is “actually located” in
Utah regardless of whether the individual is using technologies that make it appear that the user
is accessing the platform from another state or country. Plaintiffs seek a preliminary injunction
preventing Utah’s recent amendment from going into effect.1 Plaintiffs assert that, because it is
impossible to know with certainty where a user is physically located, this amendment requires it
1 Pls.’ Mot. for a Prelim. Inj. & Mem. in Supp. (“PI Mot.”), ECF No. 3, filed April 22, 2026.
1
to age-verify every user of its platforms throughout the world. According to Plaintiffs, this
violates constitutional principles regarding extraterritorial regulation, the dormant Interstate
Commerce Clause, and the dormant Foreign Commerce Clause. Utah responds that the statute
demands not perfection but reasonable efforts to determine whether a user is actually located in
Utah. After full consideration of each party’s briefing and oral argument, the court finds that
Plaintiffs are likely to succeed on the merits, they have shown irreparable harm, and the equities
favor an injunction. Thus, Plaintiffs’ request for a preliminary injunction is granted.
BACKGROUND
Plaintiffs, Aylo Freesites Ltd and its parent company Aylo Group Ltd, (collectively,
“Aylo”) are technology and media companies that operate several adult-entertainment platforms,
including Pornhub, Youporn, and Redtube.2 Aylo Freesites Ltd specifically operates free adult-
entertainment platforms, while other Aylo-affiliated platforms (also owned by Aylo Group Ltd)
distribute adult content for paid accounts.3 Across the world, Aylo’s free sites receive over 200
million active visitors each month.4 Approximately 86% of those visitors are believed to be
outside the United States.5
In 2023, Utah passed a law that required certain adult-content providers to
“perform reasonable age verification methods to verify the age of an individual attempting to
access [material harmful to minors],” the “age verification provision.”6 After the law’s
2 Decl. of Andreas Alkiviades Andreou in Supp. of Pls.’ Mot. for Prelim. Inj. (“Andreou Decl.”) ¶ 5, ECF No. 3-1,
filed April 22, 2026.
3 Id.; PI Mot. 5.
4 Decl. of Graham Collie in Supp. of Pls.’ Mot. for Prelim. Inj. (“Collie Decl.”) ¶ 12, ECF No. 3-2, filed April 22,
2026.
5 Id.
6 Utah Code § 78B-3-1002(1)(a).
2
enactment, Aylo initially blocked Utah-based Internet Protocol (IP) addresses from accessing its
free adult-content sites because of privacy concerns with the age verification requirement.7 Aylo
later made the sites available to Utah-based IP addresses but limited them to content that does
not fall within the scope of Utah’s age verification law.8
In 2026, Utah amended its age verification law.9 The amendment reworked a definition
of “reasonable age verification methods” to now read:
“[T]he processes or means used by a commercial entity to verify that the person
seeking to access the material is 18 years or older including by: (a) use of a digitized
identification card . . .; (b) verification through an independent, third-party age
verification service that compares the personal information entered by the
individual who is seeking access to the material . . . that is regularly used . . . for
the purpose of age and identity verification; (c) any commercially reasonable
method . . . to verify the age of the person attempting to access the material; or (d)
any process or mean established by the division by rule.”10
It further added enforcement and rulemaking powers for Utah’s Division of Consumer
Protection.11 And, at issue here, the amendment added the “actual-location provision.”12
An individual is considered to be accessing the website from this state if the
individual is actually located in the state, regardless of whether the individual is
using a virtual private network, proxy server, or other means to disguise or
misrepresent the individual’s geographic location to make it appear that the
individual is accessing a website from a location outside this state.13
7 Collie Decl. ¶¶ 8–9.
8 Id.
9 S.B. 73, 66th Leg., 2026 Gen. Sess. § 14 (Utah 2026) (effective May 6, 2026).
10 UTAH CODE § 78B-3-1001(11).
11 Id. §§ 78B-3-1004 to 1005.
12 Plaintiffs call this amendment the “Deemed-Location Provision” throughout their briefs. Because the statute says
that it applies to individuals “actually located” in Utah, the court refers to the provision using the language of the
statute rather than adopting the title used by Aylo.
13 Id. § 78B-3-1002(3) (emphasis added).
3
In Aylo’s view, the actual-location provision significantly alters the reach of the age
verification law.14 Before the enactment of the actual-location provision, Aylo sought to comply
with Utah’s age verification statute by blocking known Utah-based IP addresses from accessing
adult content on its free sites.15
However, all the parties agree that IP-based geolocation is underinclusive because it fails
to account for technologies that obscure a user’s location.16 These technologies, including virtual
private networks (“VPNs”) and proxy servers, mask a user’s true location by routing traffic
through IP addresses corresponding to different geographic locations.17 VPNs and location-
obfuscation technologies have entirely legitimate purposes—such as securing communications
on public networks, preventing websites from harvesting personal data, and circumventing
censorship by oppressive governments.18 But these technologies can also be used to circumvent
IP-based geolocation restrictions, such as the one used by Aylo for its free sites.19 Utah
presumably passed the actual-location provision to address this issue.
But both parties also agree that there is no way for a website operator to determine a
user’s physical location with perfect certainty.20 Aylo argues that Utah’s actual location
requirement means that Aylo must “impose age verification on every user of their platforms,
everywhere in the world” because it is impossible to know for sure whether any given user
14 But see Defs.’ Opp’n to Pls.’ Mot. for Prelim. Inj. (“Opp.”) 6, ECF No. 43, filed June 8, 2026 (asserting that the
amendment merely made explicit what the statute already required).
15 Collie Decl. ¶¶ 8–9.
16 Prelim. Ex. Decl. of Dr. Gregory J. Rattray (“Rattray Decl.”) ¶¶ 18, 42–48, ECF No. 3-3, filed April 22, 2026;
Decl. of Tony Allen (“Allen Decl.”) ¶ 81, ECF No. 43-4, filed June 8, 2026.
17 Allen Decl. ¶ 81.
18 Rattray Decl. ¶ 35.
19 Allen Decl. ¶ 82–83.
20 Rattray Decl. ¶¶ 16–20; Ex. Decl. of Chad Kornett (“Kornett Decl.”) ¶ 24, ECF No. 43-2, filed June 8, 2026.
4
actually is in Utah.21 Utah responds that there are reasonable methods to detect location-
obfuscation technologies and determine a user’s physical location with a high degree of
reliability, though the accuracy will be less than perfect.
For example, Utah identifies one potential three-step method to reasonably identify a
user’s physical location that it states would comply with the statute.
First, the company would detect the use of a VPN or other location-obfuscation
technology.22 Multiple commercial vendors provide these services.23 The parties’ experts dispute
the overall degree of reliability of these services, but no party disputes that they can assist in
detecting location-obfuscation technologies.24
Second, the company would estimate the likelihood of Utah presence based on “non-IP
indicators such as device time zone, locale and language settings, currency preferences, browser
Accept-Language headers, device region settings, and historical account activity.”25 This would
narrow a user’s likely possible location because, for example, a Utah-based user would be
unlikely to have their time zone set to India, browser language set to Hindi, and their transaction
currency set to rupees.26 That said, all parties also agree that these indicators are imperfect.27 For
example, Aylo estimates that it has approximately 1.26 million monthly visits from users in the
21 Pls.’ Compl. for Declaratory & Injunctive Relief (“Compl.”) 14, ECF No. 1, filed April 22, 2026.
22 Kornett Decl. ¶ 25; Opp’n at 16.
23 Allen Decl. ¶ 93–95.
24 Kornett Decl. ¶ 23; Rebuttal Ex. Decl. of Dr. Gregory J. Rattray (“Rattray Supp. Decl.”) ¶¶ 8, 43–46, ECF No. 55-
1, filed July 10, 2026.
25 Opp. 24–25; Kornett Dec., ¶¶ 36–37.
26 Opp. 25.
27 Rattray Supp. Decl. ¶¶ 25–29; Graham Collie Supp. Decl. (“Collie Supp. Decl.”) ¶¶ 29–33, ECF No. 53-2, filed
July 10, 2026; Kornett Decl., ¶¶ 37, 41 (stating that this only provides a “reliable approximation of a user’s likely
jurisdiction to a reasonable degree of confidence”).
5
Mountain Time Zone with their browser language set as English.28 Under Utah’s proposed
method, anyone in that group using a VPN would likely be included in this step, whether they
are located in Utah, Colorado, or any other place in the world.29
Third, the users that remain after the first two steps would then be offered three different
options: (1) provide device location data; (2) provide age assurance; or (3) disable their VPN to
ascertain the users’ true IP address and location.30 Again, Aylo disputes the reliability of these
steps because, for example, even device location data can be falsified.31 But they do not dispute
that such actions can increase reliability and barriers for users to obscure their location.
Similarly, the parties’ experts disagree on the exact effectiveness of various tools and
methods, but they do not dispute that such methods increase the likelihood of determining a
user’s location. The parties’ experts also agree that all methods of determining a user’s physical
location on the internet are both under and over inclusive and subject to manipulation. And the
parties agree that available methods do not allow an entity to perfectly determine every user’s
location.32
28 Collie Supp. Decl. ¶¶ 30–33.
29 Id.
30 Kornett Decl. ¶ 38; Opp. 25–26.
31 Kingsmead Security Report 10, ECF No. 53-3, filed July 10, 2026 (“Some device types allow the user to fake
locations. . . . for example . . . Android has many location faking apps, many of which have been downloaded
millions of times.”).
32 The parties, of course, fiercely contest the efficacy of methods for detecting VPN or proxy usage, as well as the
methods for geolocating those that obfuscate their location. But to be sure, Utah never suggests that the currently
available methods allow for an entity to do either of these perfectly. Opp. 19; Kornett Decl. ¶ 23. And for
geolocation of those detected to be using a VPN (or a similar tool), Utah makes “no suggestion of perfection.” Hr’g
Tr. 85, ECF No. 63, filed Aug. 27, 2026.
6
STANDARD
A preliminary injunction is an “extraordinary remedy that may only be awarded upon a
clear showing that the plaintiff is entitled to such relief.”33 “Because a preliminary injunction is
an extraordinary remedy, the movant’s right to relief must be clear and unequivocal.”34
“A plaintiff seeking a preliminary injunction must establish [(1)] that he is likely to
succeed on the merits, [(2)] that he is likely to suffer irreparable harm in the absence of
preliminary relief, [(3)] that the balance of equities tips in his favor, and [(4)] that an injunction
is in the public interest.”35 “[T]he third and fourth factors ‘merge’ when, like here, the
government is the opposing party.”36
DISCUSSION
I. Facial Challenge
As a threshold issue, the court addresses the standard for a facial challenge to the
constitutionality of the actual-location provision. While neither party briefed the standards for a
facial constitutional challenge, the court is bound to apply the proper standard.37
First, Plaintiffs clearly present a facial challenge rather than an as-applied challenge.
Aylo seeks a “preliminary injunction barring Defendants from enforcing Utah Code § 78B-3-
1002(3) [the actual-location provision] . . . on the grounds that the statute constitutes
impermissible extraterritorial regulation, violates the dormant Commerce Clause, and is contrary
33 Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 22
(2008). 34 Diné Citizens Against Ruining Our Env’t v. Jewell,839 F.3d 1276, 1281
(10th Cir. 2016). 35 Winter,555 U.S. at 20
. 36 Rocky Mountain Gun Owners v. Polis,121 F.4th 96, 112
(10th Cir. 2024). 37 See Moody v. NetChoice, LLC,603 U.S. 707
, 723–26 (2024); Gardner v. Galetka,568 F.3d 862, 879
(10th Cir.
2009) (“It is one thing to allow parties to forfeit claims, defenses, or lines of argument; it would be quite another to
allow parties to stipulate or bind us to application of an incorrect legal standard . . . .”).
7
to the Foreign Commerce Clause.”38 Aylo does not limit its preliminary injunction request to
certain applications of the actual-location provision, nor is it defending itself against a specific
application.
Aylo’s choice to bring a facial challenge “comes at a cost.”39 A facial challenge imposes
a “heavy burden”40: “a plaintiff cannot succeed on a facial challenge unless he ‘establish[es] that
no set of circumstances exists under which the [law] would be valid,’ or he shows that the law
lacks a ‘plainly legitimate sweep.’”41
This heavy burden is imposed “for a host of good reasons.”42 “Claims of facial invalidity
often rest on speculation [and] raise the risk of ‘premature interpretation of statutes on the basis
of factually barebones records.’”43 This premature interpretation “los[es] the lessons taught by
the particular, to which [the] common law method normally looks.”44 Indeed, “[t]he delicate
power of pronouncing a [legislative act] unconstitutional is not to be exercised with reference to
hypothetical cases thus imagined.”45 “Facial challenges also run contrary to the fundamental
principle of judicial restraint that courts should neither ‘anticipate a question of constitutional
law in advance of the necessity of deciding it’ nor ‘formulate a rule of constitutional law broader
38 PI Mot. 1.
39 Moody, 603 U.S. at 723.
40 United States v. Salerno, 481 U.S. 739, 745
(1987). 41 Moody, 603 U.S. at 723 (first quoting Salerno,481 U.S. at 745
; and then quoting Washington State Grange v. Washington State Republican Party,552 U.S. 442
(2008)). 42 Id. at 723. 43 Washington State Grange,552 U.S. at 450
(quoting United States v. Raines,362 U.S. 17, 22
(1960)). 44 Sabri v. United States,541 U.S. 600, 609
(2004); Yazoo & Mississippi Valley R. Co. v. Jackson Vinegar Co.,226 U.S. 217, 220
(1912) (“How the state court may apply [a statute] to other cases, whether its general words may be treated as more or less restrained, and how far parts of it may be sustained if others fail are matters upon which we need not speculate now.”). 45 Raines,362 U.S. at 22
.
8
than is required by the precise facts to which it is to be applied.’”46 And “facial challenges
threaten to short circuit the democratic process by preventing laws embodying the will of the
people from being implemented in a manner consistent with the Constitution.”47 The Supreme
Court “has therefore made facial challenges hard to win.”48
The parties dispute whether the actual-location provision imposes strict liability or
instead only requires reasonable methods to discern a user’s actual location. Because Aylo’s
argument rests on concerns that Utah’s law requires it to impose age verification requirements on
everyone—not just those present in Utah—to avoid strict liability, the court first addresses the
relevant statutory interpretation questions.
II. Statutory Interpretation
The disputed interpretation of the statutory amendment at issue is central to Aylo’s facial
challenge, so the court undertakes that inquiry prior to evaluating Aylo’s constitutional claims.
First, the parties dispute whether the actual-location provision and reasonable age
verification provision require a commercial entity, like Aylo, to always age verify an individual
accessing its website who is actually located in Utah49—or, as Utah argues, whether they allow
for something less, such as a reasonable efforts standard.50
46 Washington State Grange, 552 U.S. at 450
(quoting Ashwander v. TVA,297 U.S. 288
, 346–347 (1936) (Brandeis,
J., concurring)).
47 Id. at 451.
48 Moody, 603 U.S. at 723.
49 PI Mot. 2.
50 Opp. 22, 43; Hr’g Tr. 39, 50–54.
9
The court begins with the text of the statute.51 “The plainness of statutory language ‘is
determined by reference to the language itself, the specific context in which that language is
used, and the broader context of the statute as a whole.’”52 “If the plain language of the statute is
clear, our inquiry ordinarily ends.”53
The age verification provision commands that “[a] commercial entity that . . . publishes
or distributes material harmful to minors on the internet from a website . . . shall perform
reasonable age verification methods to verify the age of an individual attempting to access the
material.”54 In the Definitions section, the phrase “reasonable age verification methods” is
defined as “the processes or means used by a commercial entity to verify that the person seeking
to access the material is 18 years old or older.”55 That section then provides that those “processes
or means . . . includ[e]”: “use of a digitized identification card,” “verification through a[] . . .
verification service that compares the personal information entered . . . to the material that is
available from a commercially available database . . . for the purpose of age and identity
verification,” “any commercially reasonable method that relies on . . . transactional data to verify
the age of the person attempting to access the material,” or “any process or means established by
the division by rule.”56 Accordingly, as to age verification methods, the statute plainly states that
51 See Wilson v. Stocker, 819 F.2d 943, 948
(10th Cir. 1987) (“In determining the scope of a statute, a court must begin with the statutory language itself.”); Webb v. Hodel,878 F.2d 1252, 1255
(10th Cir. 1989) (“In construing a statute, the court must begin with the statutory language itself.”). 52 United States v. Burkholder,816 F.3d 607, 614
(10th Cir. 2016) (quoting Salazar v. Butterball, LLC,644 F.3d 1130, 1136
(10th Cir. 2011)). 53 Jewell v. United States,749 F.3d 1295, 1298
(10th Cir. 2014).
54 UTAH CODE § 78B-3-1002(1)(a) (emphasis added).
55 Id. § 78B-3-1001(11).
56 Id.
10
they must be “reasonable,” and then provides four means that constitute reasonable methods
under the statute.
By contrast, the actual-location provision states, in its entirety: “An individual is
considered to be accessing the website from this state if the individual is actually located in the
state, regardless of whether the individual is using a virtual private network, proxy server, or
other means to disguise or misrepresent the individual’s geographic location to make it appear
that the individual is accessing a website from a location outside this state.”57 Unlike the age
verification requirement, the actual-location provision does not contain the word “reasonable.”
Neither does the statute’s definitions section nor any other part of the statute state that efforts to
identify an individual’s actual location need only be reasonable or provide a definition for what
constitutes reasonable geolocation efforts.
Aylo argues that the “proper reading” of the statutory provisions is that a company like it
“faces liability any time an individual located in Utah accesses adult content without being age-
verified, even when that company does not know the individual is located in Utah.”58 That is
because “reasonableness” is not included in the actual-location provision, so any interpretation
otherwise would be “wholly atextual.”59 Utah, however, asserts that the entire statute only
requires “reasonable efforts”60—not only as to age verification but also for geolocation of
“individual[s] attempting to access the material.”61 It argues that reading the statutory language
57 Id. § 78B-3-1002(3).
58 Pls.’ Reply Mem. in Supp. of Mot. for a Prelim. Inj. (“PI Reply”) 8, ECF No. 55, filed July 10, 2026 (emphasis
omitted).
59 Id. at 5.
60 Opp. 1.
61 Hr’g Tr. 40, 51–54.
11
as a whole requires such an interpretation.62 The court agrees with Aylo’s reading because it
comports with the plain language of the statute.
The word “reasonable” only appears in the parts of the statute addressing age verification
methods. The statute requires that commercial entities like Aylo “shall perform reasonable age
verification methods” and supplies four definitions for what constitutes said “reasonable age
verification methods.” “Reasonable” immediately precedes and clearly modifies only “age
verification methods.”63 Indeed, that section makes plain that the reasonable age verification
methods are “to verify the age of an individual attempting to access the material,” which says
nothing about what actions the entity must take to determine the location of “individual[s]
attempting to access the material” identified by the statute.64
The actual-location provision, however, answers the question of who an entity must age
verify with those reasonable age verification methods.65 Per the provision, the requirement for
reasonable age verification applies to individuals “actually located in the state, regardless of
whether the individual is using a [VPN], proxy server, or other means to disguise . . . the
individual’s geographic location.”66 That provision is not qualified by any reasonable efforts
language. If the Utah Legislature intended to apply a reasonableness qualifier, then it certainly
could have. After all, the Legislature “knew how to do so and did so expressly”67 by its
62 Id. at 52, 54.
63 UTAH CODE § 78B-3-1002(1)(a).
64 See id. (emphasis added).
65 See id. § 78B-3-1002(3).
66 Id.
67 FS Credit Opportunity Corp. v. Saba Cap. Master Fund, Ltd, 608 U.S. 608
, 617 (2026) (quoting Touche Ross & Co. v. Redington,442 U.S. 560, 572
(1979)); see also Burkholder, 816 F.3d at 615–16 (referencing other statutes to discern that “Congress clearly knew how to add a proximate-cause requirement . . . when it wished to do so. . . . That it nevertheless did not do so in [this statute] is thus very telling; indeed, it suggests that Congress intended to omit [the] requirement”); McKitrick v. Gibson,2024 UT 1
, ¶¶ 35–36,541 P.3d 949
(calling it “standard statutory-
12
modification of “age verification methods” as only needing to be “reasonable.”68 The
Legislature’s decision to omit such language when addressing an entity’s geolocation
responsibilities is telling.
Similarly, a holistic reading of the provisions confirms that reasonableness does not apply
to the statute’s geolocation requirements.69 The Legislature chose to make “reasonable age
verification methods” a defined term instead of leaving it undefined.70 And because the
Legislature chose to define what “reasonable” age verification methods means, the word
“reasonable” no longer has any independent content: for statutory purposes, it simply takes on
the meaning given it by the Legislature. The statute defines those “reasonable” methods as
“processes or means used by a commercial entity to verify that the person seeking to access the
material is 18 years old or older.”71 And in the list of what those “processes or means” include
are methods aimed at verifying only the age of an individual—for example, it includes using a
digital ID, using a verification service that utilizes databases “for the purpose of age and identify
verification,” and using data specifically “to verify the age of the person.”72 None of these
processes or means address an entity’s approach to or responsibility for geolocation. Taken
together, the statute’s plain language uses “reasonable age verification methods” to mean
interpretation practice” to “presume the omissions of restrictive language to be [purposeful],” in the context of such
language being used in a different, related provision).
68 UTAH CODE § 78B-3-1002(1)(a).
69 See United States v. Caldwell, 128 F.4th 1170, 1175
(10th Cir. 2025) (describing statutory interpretation as a “holistic endeavor” (citation omitted)). 70 See UTAH CODE § 78B-3-1001(11). 71 Id. (emphases added). 72 Id. § 78B-3-1001(11)(a)–(c). Also included in the list is “any process or means established by the division by rule.” Id. § 78B-3-1001(11(d). But the extent of those processes or means established by rule is informed by the enumerated examples in the rest of the list—i.e., it would concern how the entity verifies an individual’s age. See, e.g., Fischer v. United States,603 U.S. 480, 488
(2024) (discussing the “idea . . . that a general phrase can be given
a more focused meaning by the terms linked to it.”).
13
specific processes or means an entity shall use to verify an individual’s age—not the discovery
of an individual’s location to determine if that individual “is actually located in the state.”
All that said, Utah proffers that it will only enforce the actual-location provision under a
standard of reasonableness.73 Courts generally will consider a narrowing construction of a state
statute “by those charged with its enforcement.”74 And the court credits the Utah Attorney
General’s statement about intended enforcement. But because a court does not “uphold an
unconstitutional statute merely because the Government promised to use it responsibly,”75 courts
“may impose a limiting construction on a statute only if it is readily susceptible to such a
construction.”76
Here, as detailed above, the relevant statutory language is plain and unambiguous. The
actual-location provision does not contain any reasonable efforts qualifier, so to accept Utah’s
interpretation and read one into the statute would require “rewriting, not just reinterpretation.”77
73 Hr’g Tr. 51. After briefing and oral argument, Defendants also filed a declaration alerting the court to a proposed
rule on geolocation detection. Hass Suppl. Decl. attaching proposed rule, ECF No. 61, filed August 18, 2026.
Because the proposed rule came after briefing and oral argument, the court does not consider it here.
74 See, e.g., Quik Payday, Inc. v. Stork, 549 F.3d 1302, 1308
(10th Cir. 2008) (adopting a proffered limiting construction that was a “reasonable interpretation” of the statute); Ward v. Rock Against Racism,491 U.S. 781
, 795– 96 (1989) (“[I]n evaluating a facial challenge to a state law, a federal court must consider any limiting construction that a state court or enforcement agency has proffered.” (quoting Hoffman Estates v. The Flipside, Hoffman Estates, Inc.,455 U.S. 489
, 494 n.5 (1982))). 75 United States v. Stevens,559 U.S. 460, 480
(2010). 76Id.
at 481 (quoting Reno v. ACLU,521 U.S. 844, 884
(1997)); see also Strenberg v. Carhart,530 U.S. 914, 944
(2000) (“We are aware that adopting the Attorney General’s interpretation might avoid the constitutional problem . . . [b]ut we are ‘without power to adopt a narrowing construction of a state statute unless such a construction is reasonable and readily apparent.’” (quoting Boos v. Barry,485 U.S. 312, 330
(1988))); ACLU v. Johnson,194 F.3d 1149, 1159
(10th Cir. 1999) (recognizing that courts may narrowly construe state statutes, but “the statute must be readily susceptible to the narrowing construction”); Rosenblatt v. City of Santa Monica,940 F.3d 439, 447
(9th Cir. 2019) (“Federal courts ‘must accept a narrowing construction to uphold the constitutionality of an ordinance if its language is ‘readily susceptible’ to it.” (quoting Nunez ex rel. Nunez v. City of San Diego,114 F.3d 935, 942
(9th Cir. 1997))). 77 Stevens,559 U.S. at 481
; see also Johnson194 F.3d at 1159
(“[The state’s] proposed narrowing construction
really amounts to a wholesale rewriting of the statute. That we cannot do.”).
14
Therefore, the court cannot accept Utah’s proffered interpretation because the actual-location
provision, as written, is not readily susceptible to it.78
In sum, the actual-location and reasonable age verification provisions together impose
liability on a commercial entity that fails to take defined steps to verify the age of an individual
who is “attempting to access the material” and “is actually located in the state.” It cannot be read
to require only reasonable efforts at determining whether such individuals are located in Utah.
Second, the parties contest whether the amendment to add the actual-location provision
made any material change to the pre-existing requirements under the reasonable age verification
provision.79
Prior to the amendment at issue, the age verification provision contained the only
indication of who the statute applied to—that is, the commercial entity must age verify
“individual[s] attempting to access the material.”80 As discussed earlier, the amendment adding
the actual-location provision requires age verification of all individuals “actually located in the
state.”81 Importantly, the provision also requires age verification for all such individuals
“regardless” of whether the individual “disguise[s] or misrepresent[s] the individual’s geographic
location” through use of tools like a VPN or proxy server.82
78 See Wyoming v. Oklahoma, 502 U.S. 437, 460
(1992) (declining, in the Commerce Clause context, to adopt a state’s suggested interpretation because “it is clearly not this Court’s province to rewrite a state statute”); Wilson v. Stocker,819 F.2d 943, 948
(10th Cir. 1987) (declining the Oklahoma “Attorney General’s invitation to give the [state] statute a construction more restrictive than that provided by its plain language”); Eisenberg v. Sanchez,806 F. Supp. 3d 1197
, 1201–02 (D. Nev. 2025) (declining a narrowing construction to save a statutory scheme from the
Commerce Clause because “[w]hile this court must accept any readily susceptible, narrow construction of the statute
to uphold its constitutionality, the State’s construction would effectively read [provisions] out of the statutory
scheme, which this court cannot do”).
79 Hr’g Tr. 78–79, 83–84.
80 UTAH CODE § 78B-3-1002(1).
81 Id. § 78B-3-1002(3).
82 Id.
15
Utah suggests that the actual-location provision did not have much impact outside of
what was already required by the reasonable age verification provision. Utah asserts that the
amendment made the “requirement to age-assure users who mask their location . . . explicit with
the passage of the Actual-Location Provision in 2026.”83 But it does not persuasively explain
why that is so. Aylo, for its part, argues that Utah’s suggested reading of the actual-location
provision would render the provision and the Legislature’s act of amendment as surplusage.84
The court agrees.
Courts recognize a “preference for avoiding surplusage constructions.”85 “[T]he canon
against surplusage indicates that we generally must give effect to all statutory provisions, so that
no part will be inoperative or superfluous—each phrase must have distinct meaning.”86 Such an
approach corresponds with the “familiar doctrine that [a legislative body] cannot be presumed to
do a futile thing.”87 As a result, the court will “avoid [an] interpretation that renders” provisions
in the statute “surplusage.”88 Noteworthy here, a court’s reluctance to read surplusage into a
statute “increases when [the legislative body] amends a statute, as [courts] ordinarily presume
that when [the legislative body] does so, ‘it intends its amendment to have real and substantial
effect.’”89
83 Opp. 6.
84 Hr’g Tr. 57, 78–79.
85 Navajo Nation v. Dalley, 896 F.3d 1196, 1215
(10th Cir. 2018); see also Turner v. Staker & Parson Companies,2012 UT 30, ¶ 12
,284 P.3d 600
(“Wherever possible, we give effect to every word of a statute, avoiding ‘[a]ny interpretation which renders parts or words in a statute inoperative or superfluous.” (quoting State v. Arave,2011 UT 84, ¶ 28
,268 P.3d 163
)). 86 Dalley,896 F.3d at 1215
. 87 Halverson v. Slater,129 F.3d 180, 185
(D.C. Cir. 1997), cited favorably by Dalley,896 F.3d at 1216
. 88 Dalley,896 F.3d at 1216
. 89 Bufkin v. Collins,604 U.S. 369, 386
(2025) (quoting Intel Corp. v. Advanced Micro Devices, Inc.,542 U.S. 241
,
258–59 (2004)).
16
Here, reading the actual-location provision as “just a clarification of” the pre-existing
reasonable age verification provision would conflict with the presumption against surplusage.90
Utah has not provided a sufficient basis to overcome that presumption. The reasonable age
verification provision itself says nothing about geolocation or an entity’s responsibility to age-
verify individuals who appear to be located outside of Utah because of the technology they are
using. Those requirements were only introduced in the language of the actual-location provision.
If the Legislature intended to include those geolocation requirements in its original passage of
the reasonable age verification provision, it did not make that intent manifest in the statutory
language. Therefore, the court gives effect to the actual-location provision and its enacting
amendment by interpreting the provision as the basis for an entity’s geolocation requirements.
In short, Aylo is correct that the statute, as amended, now essentially imposes strict
liability for entities like it when it comes to determining the location of its websites’ users.
III. Substantial Likelihood of Success on the Merits
The court next considers whether Aylo has shown that it is likely to prevail on the merits
of one or more of its claims. Aylo brings three claims: That the actual-location provision (1) is
impermissible extraterritorial legislation; (2) violates the dormant Commerce Clause; and
(3) violates the Foreign Commerce Clause. The court considers the first two challenges but
declines to reach the last.
90 Hr’g Tr. 84.
17
A. Extraterritorial Regulation
Aylo first argues that the actual-location provision is impermissible extraterritorial
legislation because the statute’s practical effect regulates conduct outside Utah’s borders. Aylo
contends that the statute imposes Utah’s policy on other states that have rejected implementing
age verification laws and in fact have taken steps in the opposite direction to protect users’
privacy and location data. Aylo’s argument relies primarily on three Supreme Court cases: BMW
of North America, Inc. v. Gore; State Farm Mut. Auto. Ins. Co. v. Campbell; and New York Life
Insurance Co. v. Head.91 And it makes its argument under the Due Process Clause’s so-called
federalism principles.92 Utah responds that Aylo ignores the Supreme Court’s recalibration of the
extraterritoriality doctrine in National Pork Producers Council v. Ross,93 and that, regardless,
none of Aylo’s cited cases supports its arguments.
“A basic principle of federalism is that each State may make its own reasoned judgment
about what conduct is permitted or proscribed within its borders . . . .”94 By extension of that
principle, “it is clear that no single State . . . [can] impose its own policy choice on neighboring
States.”95 Indeed, “one State’s power to impose burdens on the interstate market . . . is also
constrained by the need to respect the interests of other states[.]”96 Thus, “courts must sometimes
91 BMW of N. Am., Inc. v. Gore, 517 U.S. 559, 571
(1996); State Farm Mut. Auto. Ins. Co. v. Campbell,538 U.S. 408
(2003); New York Life Insurance Co. v. Head,234 U.S. 149
(1914). 92 PI Mot. 10. 93 Nat’l Pork Producers Council v. Ross,598 U.S. 356
(2023). 94 State Farm Mut. Auto. Ins. Co.,538 U.S. 408, 422
(2003); see also Bonaparte v. Tax Court,104 U.S. 592, 594
(1881) (“No State can legislate except with reference to its own jurisdiction. . . . Each State is independent of all the others in this particular”). 95 Gore,517 U.S. at 571
. 96Id.
(first citing Healy v. Beer Institute,491 U.S. 324
, 335–336 (1989) (the Constitution has a “special concern both with the maintenance of a national economic union unfettered by state-imposed limitations on interstate commerce and with the autonomy of the individual States within their respective spheres” (footnote omitted)); and then citing Edgar v. MITE Corp.,457 U.S. 624, 643
(1982)).
18
referee disputes about where one State’s authority ends and another’s begins . . . .”97 “To resolve
disputes about the reach of one State’s power, [the Supreme Court] has long consulted original
and historical understandings of the Constitution’s structure and the principles of ‘sovereignty
and comity’ it embraces.”98
Relying on these principles, Aylo focuses on three cases to argue that Utah’s statute is
unconstitutional extraterritorial legislation: Gore, Campbell, and Head.
In Gore, the Court considered the constitutionality of punitive damages.99 There, an
Alabama state court imposed punitive damages against BMW for failing to disclose presale
repairs before selling a car as new.100 The Alabama court based its punitive damages number in
part on BMW’s failure to disclose presale repairs nationwide, including in other states.101
However, every state across the union had different disclosure laws, creating a “patchwork of
rules representing the diverse policy judgments of lawmakers in 50 States.”102 Indeed, some of
the out-of-state conduct on which the Alabama court based its punitive damages award was
97 Pork Producers, 598 U.S. at 375
. The parties dispute the application of Pork Producers to Aylo’s extraterritoriality arguments. Indeed, Pork Producers primarily dealt with the dormant Commerce Clause, not the extraterritorial doctrines that Aylo invokes here.Id. at 371
(“In the first, petitioners invoke what they call ‘extraterritoriality doctrine.’ They contend that our dormant Commerce Clause cases suggest an additional and ‘almost per se’ rule forbidding enforcement of state laws that have the ‘practical effect of controlling commerce outside the State,’ even when those laws do not purposely discriminate against out-of-state economic interests.”) (internal citation omitted) (emphasis added);Id.
at 408–10 (Kavanaugh, J., concurring in part) (stating that “[t]hus far, legal challenges to California’s Proposition 12 have focused on the Commerce Clause and this Court’s dormant Commerce Clause precedents”). That said, in cabining its decision, the Court briefly discussed “the role territory and sovereign boundaries play in our federal system” and how “courts must sometimes referee disputes about where one State’s authority ends and another’s begins . . . .”Id. at 375
(majority opinion). While that discussion may be dicta, this court is “bound by Supreme Court dicta almost as firmly as by the Court’s outright holdings, particularly when the dicta is recent and not enfeebled by later statements.” N. Mill St., LLC v. Aspen,6 F.4th 1216
, 1228 n.11 (10th Cir. 2021) (citation modified). 98 Pork Producers,598 U.S. at 376
(quoting Gore,517 U.S. at 572
). 99 Gore,517 U.S. at 568
. 100Id.
at 564–65. 101Id.
at 565–67. 102Id. at 570
.
19
lawful in that state, such as some states that exempted minor repairs from the disclosure
requirements.103 Relying on “principles of state sovereignty and comity,” the Supreme Court
held that, while “Alabama may insist that BMW adhere to a particular disclosure policy in that
State[,]” “Alabama does not have the power . . . to punish BMW for conduct that was lawful
where it occurred and that had no impact on Alabama or its residents.”104 By extension, “[n]or
may Alabama impose sanctions on BMW in order to deter conduct that is lawful in other
jurisdictions.”105 Thus, the Court explained, the punitive damages award must be based “solely
on conduct that occurred within Alabama.”106
Campbell is very similar. In that case, the plaintiff alleged fraud and intentional infliction
of emotional distress based on the insurance company’s decision to take a case to trial rather than
settle.107 As part of the claim for punitive damages, the plaintiff introduced evidence of certain
practices by the insurance company nationwide.108 But much of the out-of-state conduct was
lawful where it occurred.109 And “[a] state cannot punish a defendant for conduct that may have
been lawful where it occurred.”110 Thus, the Court reversed the award of punitive damages.
Lastly, over a century ago in Head, Missouri applied its laws to invalidate a contract
made in a different state and between citizens from different states on the ground that the new
contract modified a prior contract executed in Missouri.111 The Supreme Court reversed, finding
103 Id. at 569, 573
. 104Id.
at 572–573. 105Id.
106Id.
at 573–74. 107 538 U.S. at 413–14. 108Id.
at 414–16.
109 Id. at 422.
110 Id. at 421.
111 234 U.S. at 160–61.
20
that Missouri had no “right to extend its authority beyond its borders so as to control contracts
made between citizens of other States and virtually in fact to disregard the law of such other
States by which the acts done were admittedly valid.”112 Relying on the freedom of contract and
the Full Faith and Credit Clause, the Court stated that “it would be impossible to permit the
statutes of Missouri to operate beyond the jurisdiction of that State . . . without throwing down
the constitutional barriers by which all the States are restricted within the orbits of their lawful
authority . . . .”113
Overall, none of these cases support the actual-location provision here being
impermissible extraterritorial legislation under the Due Process Clause or federalism principles.
Especially when read, as the Supreme Court has directed, “with a careful eye to context.”114
Gore and Campbell both center around a simple proposition: One state cannot punish an
entity for actions taken in another state where those actions were lawful. Head, similarly, dealt
with a state affirmatively reaching outside of its borders and invalidating a contract that was
lawful in the relevant state.115 But Utah’s statute is different. The actual-location provision only
imposes liability when the user is actually located in Utah. If Aylo or another adult-content
provider lawfully supplies content to a user in any other state without age verification, the statute
imposes no liability.
The Supreme Court has recognized that “[i]n our interconnected national marketplace,
many (maybe most) state laws have the ‘practical effect of controlling’ extraterritorial
112 Id. at 160.
113 Id. at 161.
114 Pork Producers, 598 U.S. at 374
.
115 The court further notes that Gore, Campbell, and Head were all as-applied challenges with well-developed
factual records and a clear application of state law.
21
behavior.”116 State income tax laws, environmental laws, and “all manner of ‘libel laws,
securities requirements, charitable registration requirements, franchise laws, tort laws,’ and
plenty else besides” all have extraterritorial effects.117 As a result, the Court recently held that
there is no “almost per se rule against laws that have the practical effect of controlling
extraterritorial commerce.”118 Aylo has failed to show that the extraterritorial effect of Utah’s
actual-location provision is of the same kind as those laws invalidated in Gore, Campbell, and
Head.
Next, Aylo turns to examples where Utah’s law may cause conflicts with the laws of
other states, arguing that this shows that the actual-location provision infringes on the policy
choices of other states.119 But these conflicts fail to support Aylo’s facial challenge because
(1) the conflicts are hypothetical, and (2) the conflicts go both ways.
Utah’s law need not necessarily conflict with the data privacy laws of other states
because those laws still allow gathering location information when reasonably or strictly
necessary. Aylo specifically points to Colorado and Maryland’s data privacy laws. Colorado’s
law requires any personal data collection to be reasonably necessary, requires consent for
processing sensitive data, and prohibits discriminating against users who exercise their data-
privacy rights.120 Similarly, Maryland prohibits websites from processing geolocation data
except where “strictly necessary to provide or maintain a specific product or service requested by
116 Pork Producers, 598 U.S. at 374
. 117Id.
at 374–75 (quoting J. Goldsmith & A. Sykes, The Internet and the Dormant Commerce Clause,110 Yale L. J. 785
, 804 (2001)). 118 Id. at 375 (internal quotation marks omitted). 119 See Gore,517 U.S. at 572
(“[I]t is clear that no single State could . . . impose its own policy choice on
neighboring States.”).
120 See COLO. REV. STAT. § 6-1-1308(1)(c), (3), (7).
22
the consumer to whom the personal data pertains.”121 Those statutes could be applied to bar Aylo
from processing geolocation data in those states, but they could just as easily be applied to
permit it. A court could conclude that Aylo’s need for geolocation data to comply with differing
state laws, including Utah’s, is reasonably or strictly necessary. And on a facial challenge, Aylo
must show no circumstance where the actual-location provision is constitutional: it is not enough
to argue that “[i]t is far from clear that Maryland would consider age-verification of users located
in Maryland ‘strictly necessary.’”122 Potential conflict between state laws is not enough.123
And even if there likely would be a conflict, the conflict would be a two-way street.
Utah’s law arguably would impose Utah’s policy choices on Colorado by requiring location data
or age verification for some users in Colorado, while Colorado’s law arguably would impose
Colorado’s policy choices on Utah by interfering with location‑data collection and permitting
age‑verification obfuscation for users in Utah. Untangling the two-way conflict would be a
difficult and delicate process. Aylo does not explain which state law should give way to the
other. A facial challenge is not well-suited to resolving such possible future conflicts.
In sum, Aylo has failed to meet its burden to show that Utah’s actual-location provision is
impermissible extraterritorial legislation under Gore, Campbell, and Head. Nor has Aylo shown
actual conflict with the laws of other states.
121 MD. CODE, COM. LAW § 14-4707(a)(1); see also id. § 14-4701(gg) (“sensitive data” includes geolocation data).
122 Complaint 19.
123 United States v. Raines, 362 U.S. 17, 22
(1960) (“The delicate power of pronouncing an Act of Congress
unconstitutional is not to be exercised with reference to hypothetical cases thus imagined.” “This [c]ourt, as is the
case with all federal courts, ‘has no jurisdiction to pronounce any statute, either of a state or of the United States,
void, because irreconcilable with the constitution, except as it is called upon to adjudge the legal rights of litigants in
actual controversies.” (emphases added)).
23
B. Dormant Interstate Commerce Clause
The Constitution vests Congress with the power to “regulate Commerce . . . among the
several States.”124 The Commerce Clause “also contains a further, negative command, one
effectively forbidding the enforcement of certain state economic regulations even when Congress
has failed to legislate on the subject.”125 At its core, “the Commerce Clause prohibits the
enforcement of state laws driven by economic protectionism—that is, regulatory measures
designed to benefit in-state economic interests by burdening out-of-state competitors.”126 That
said, even if the law is nondiscriminatory both on its face and in effect, the Supreme Court “has
left the courtroom door open to challenges premised on even nondiscriminatory burdens,” which
include “a small number of [the Court’s] cases [that] have invalidated state laws that appear to
have been genuinely nondiscriminatory.”127 But “[p]reventing state officials from enforcing a
democratically adopted state law in the name of the dormant Commerce Clause is a matter of
‘extreme delicacy,’ something courts should do only ‘where the infraction is clear.’”128
Aylo argues that the actual-location provision violates the dormant Commerce Clause in
three ways: (1) it discriminates against out-of-state entities in practical effect; (2) the provision
directly regulates interstate activity with no connection to Utah; and (3) the burdens on interstate
commerce are excessive in relation to the local benefits. The court considers these arguments in
turn.
124 U.S. CONST. art. I, § 8, cl. 3.
125 Nat’l Pork Producers Council v. Ross, 598 U.S. 356, 368
(2023). 126Id. at 369
. 127Id. at 379
. 128Id. at 390
(citation modified).
24
1. Discrimination Against Out-of-State Entities
Aylo asserts that Utah’s statute is discriminatory because it forces out-of-state entities to
surrender competitive advantages they enjoy from withdrawing from the Utah market. But this
argument is flawed both factually and legally.
Aylo states that after Utah passed its age-verification law in 2023, “Aylo chose to comply
with the new law by withdrawing from the Utah adult-entertainment market” and “Aylo has thus
withdrawn from the Utah adult-entertainment market.”129 These statements are far too broad. As
to paid sites, Aylo and its affiliates have not withdrawn from Utah at all. Instead, those entities
continue to offer paid site services where they age verify all users.130 As to its free sites, Aylo
continues to provide access to Utahns, but has implemented a single method, IP address
blocking, to prevent certain Utah users from accessing content that is harmful to minors. But no
party disputes that this method is significantly underinclusive. Aylo’s free adult-entertainment
content is still available to anyone in Utah, adult or minor, using a VPN or other location-
obfuscation technology. Aylo alleges that it has enjoyed competitive advantages not from its
withdrawal from the Utah market but instead based on its choice to implement a method that
narrows access to a subset of Utahns—those using known Utah-based IP addresses. Aylo still
serves Utah users and is still subject to Utah’s laws when it comes to those users.
Neither does the actual-location provision “alter[] the competitive balance between in-
state and out-of-state firms”131 or force out-of-state companies to surrender “the advantages they
129 Complaint 2.
130 PI Reply 5.
131 Kleinsmith v. Shurtleff, 571 F.3d 1033, 1041
(10th Cir. 2009) (quoting Cherry Hill Vineyard, LLC v. Baldacci,505 F.3d 28, 36
(1st Cir. 2007)).
25
enjoy[] against their in-state rivals.”132 In those cases, “the law amounted to ‘simple economic
protectionism’” by requiring entities to “affirm (on a monthly basis) that their in-state prices
were no higher than their out-of-state prices.”133 That is nothing like the provision here. The
actual-location provision applies to in-state and out-of-state entities equally. It does not force
out-of-state entities to reduce their prices in Utah to match their prices elsewhere. Instead, both
in-state and out-of-state entities must age-verify any users actually located in Utah. Aylo
effectively seeks judicial approval for Aylo’s preferred method of partial withdrawal from the
Utah market—IP address blocking—but the dormant Commerce Clause does not protect an
entity’s “particular structure or methods of operation.”134 Aylo has not provided evidence of
discrimination or economic protectionism here.
2. Direct Regulation
Aylo next makes a direct regulation argument under the dormant Commerce Clause.135
The United States Supreme Court in Pork Producers recently weighed in on extraterritoriality
under the dormant Commerce Clause, rejecting the existence of an almost per se rule against
“state laws that have the practical effect of controlling commerce outside the State.”136 Even so,
both Aylo and Utah agree that laws that “directly regulate[] out-of-state transactions by those
132 Pork Producers, 598 U.S. at 372
. 133Id.
134 Exxon Corp. v. Governor of Maryland,437 U.S. 117, 127
(1978). 135 The parties, at times, bleed their extraterritoriality arguments (discussed supra Part III.A) into their arguments on direct regulation under the dormant Commerce Clause. That is understandable. The court keeps this discussion, however, to the parties’ arguments under the dormant Commerce Clause. 136598 U.S. at 371
(internal quotation marks omitted); see also Energy & Env’t Legal Inst. v. Epel,793 F.3d 1169, 1173
(10th Cir. 2015) (Gorsuch, J.) (analyzing the same cases Pork Producers determined to not support the almost
per se rule and noting that “a careful look at the holdings in the three leading cases suggests a concern with
preventing discrimination against out-of-state rivals or consumers”).
26
with no connection to the [regulating] State” and take place “wholly outside the [regulating]
State” may violate the dormant Commerce Clause.137
In Edgar v. MITE Corp., a plurality of the Supreme Court invalidated a law that
“directly regulate[d] transactions which [took] place . . . wholly outside the State” and had “no
connection with Illinois.”138 There, “the Act could be applied to regulate a tender offer which
would not affect a single Illinois shareholder.”139 The Court in Pork Producers, while
recognizing that Edgar seemingly stands for a proposition beyond the extraterritoriality cases it
considered as not supporting an almost per se rule, did not have occasion to wrestle with it.140
The Court merely noted that Edgar “spoke to a law that directly regulated out-of-state
transactions by those with no connection to the State,” and determined that the law at issue in
Pork Producers “do[es] not allege those conditions exist here.”141
Pork Producers apparently left the door open for the dormant Commerce Clause to
invalidate laws that directly regulate wholly out-of-state transactions with no connection to the
regulating state. Indeed, several circuit courts have recognized this direct regulation principle’s
continuing vitality since Pork Producers.142 Even so, the question still remains as to how to
approach the direct regulation inquiry post-Pork Producers.
137 Pork Producers, 598 U.S. at 376
n.1 (citation modified). 138 Edgar v. MITE Corp.,457 U.S. 624
, 641–43 (1982). 139Id. at 642
. 140 See598 U.S. at 376
n.1. 141Id.
(emphases omitted). 142 See Rhode Island Truck Ctr., LLC v. Daimler Trucks N. Am., LLC,180 F.4th 365
, 374–75, 379–80 (1st Cir. 2026) (determining that a state law that “directly regulated out-of-state transactions” violated the dormant Commerce Clause post-Pork Producers); Flynt v. Bonta,131 F.4th 918
, 924–25 (9th Cir. 2025) (“[T]he [Pork Producers] Court left open the possibility that a ‘law that directly regulated out-of-state transactions by those with no connection to the State’ could violate the dormant Commerce Clause . . . .” (quoting Pork Producers,598 U.S. at 376
n.1)); Ass’n for Accessible Meds. v. Ellison,140 F.4th 957, 961
(8th Cir. 2025) (invalidating a state law with an
extraterritorial effect post-Pork Producers and reasoning that “the facts in this case [are] analogous to those in
27
The First Circuit, in Rhode Island Truck Center, LLC v. Daimler Trucks North America,
LLC,143 recently grappled with this issue, noting that “[i]t is not entirely clear what Pork
Producers means by its reference to ‘those with no connection to’ the regulating state (there,
Illinois) in describing the out-of-state transactions that the law in Edgar directly regulated. All of
the out-of-state transactions regulated by that law concerned shares in a company that itself had
some ties to Illinois.”144 And the First Circuit reasoned that it did “not understand Pork
Producers to resolve how [courts] must address a Dormant Commerce Clause challenge to . . . a
law that . . . directly regulates out-of-state transactions.”145 So it “s[aw] no reason not to apply”
its pre-Pork Producers precedent and analysis on direct regulation claims to resolve the question
before it.146 The court takes the same approach and applies Tenth Circuit precedent in this area.
Aylo argues that because it is impossible to always determine where a user is actually
located, Utah’s actual-location provision will require it to age-verify all users, wherever they
might actually be located, or face liability. As a result, the actual-location provision operates as
an impermissible direct regulation of wholly out-of-state conduct. Aylo relies heavily on the
Tenth Circuit case ACLU v. Johnson147 and argues that the actual-location provision operates in
Edgar” because “the law directly regulates transactions which take place wholly outside the State” (citation
modified)); Novartis Pharms. Corp. v. Hanaway, 180 F.4th 1097
, 1107–08 (8th Cir. 2026) (asserting that direct regulation of out-of-state transactions violates the Commerce Clause but upholding a state law because it only “incidentally bear[s] on out-of-state transactions, it does not have a specific impermissible extraterritorial effect,” and is “consistent with [the state’s] power to regulate conduct occurring within its borders”) Nat’l Shooting Sports Found., Inc. v. James,144 F.4th 98
, 116 (2d Cir. 2025) (undertaking a dormant Commerce Clause inquiry to decide “whether [the state law] regulates commerce that takes place wholly outside of the State’s borders” (citation modified)). But cf. New Jersey Staffing All. v. Fais,110 F.4th 201, 207
(3d Cir. 2024) (determining that “the dormant Commerce Clause does not prohibit laws solely because they have extraterritorial reach absent protectionist intent or effect” without discussing Edgar). 143 Rhode Island Truck Ctr., LLC v. Daimler Trucks N. Am., LLC,180 F.4th 365
(1st Cir. 2026). 144Id.
at 374–75 (quoting Pork Producers,598 U.S. at 376
n.1). 145Id. at 375
. 146Id.
147 ACLU v. Johnson,194 F.3d 1149
(10th Cir. 1999).
28
a similar fashion to the law struck down there.148 Utah, on the other hand, contended at oral
argument that ACLU v. Johnson is distinguishable because it was decided against the backdrop
of the 1999 internet.149
In ACLU v. Johnson, the Tenth Circuit considered a dormant Commerce Clause
challenge to a New Mexico internet law that prohibited using a “computer communications
system . . . to knowingly and intentionally initiate or engage in communication with a person
under eighteen years of age when such communication in whole or in part depicts . . . sexual
conduct.”150 The court invalidated the law because it agreed the law directly “regulates conduct
occurring wholly outside of the state of New Mexico”—i.e., the law was an impermissible
“attempt to regulate interstate conduct occurring outside New Mexico’s borders[] and . . . [a]
violation of the Commerce Clause.”151 In relevant part, the court assumed that it could read the
statute as only applying to “one-on-one e-mail communications . . . from one New Mexican to
another New Mexican.”152 But even then, the court found the law to be an impermissible direct
regulation given “the reality of Internet communications” and “the nature of the Internet.”153 The
court emphasized that “geography . . . is a virtually meaningless construct on the Internet.”154
And it used this factual premise to note that even if the New Mexico law had that limited
148 PI Mot. 16–17; PI Reply 26.
149 Hr’g Tr. 45.
150 194 F.3d at 1152
. 151Id.
at 1160–61. 152Id. at 1161
. 153Id.
(citation modified). 154Id.
(quoting Am. Libraries Ass’n v. Pataki,969 F.3d 160
, 168–69 (S.D.N.Y. 1997)).
29
application, there is no guarantee it would “be limited to purely intrastate communications over
the internet because no such communications exist.”155
The requirements of the actual-location provision create concerns similar to those
analyzed in ACLU v. Johnson. As noted earlier, the actual-location provision subjects an
applicable entity to liability if it allows any user that is actually located in Utah to access its site
without age verification efforts. Although the internet has changed significantly since 1999
(twenty-seven years is an eternity in computer technology), and both parties agree to as much,156
the actual-location provision’s categorical demands make it hard for it to escape ACLU v.
Johnson.
The law requires geolocation perfection, but the parties agree that current technological
advancements do not allow an entity to perfectly (1) detect VPN/proxy users, or (2) geolocate
where all of those VPN/proxy users are accessing the site from.157 Aylo could not ensure
155 Id.
(quoting Pataki, 969 F. Supp. at 171). 156 PI Mot. 16–17 (“Courts have since recognized that advances in geolocation technology have reduced—though not eliminated—those concerns, because companies can now often identify and segment users by geography”); PI Reply 26 (“Most modern-day Internet regulations do not pose such concerns because of advancements like IP-based geolocation.”); see also Quik Payday, Inc. v. Stork,549 F.3d 1302, 1308
(10th Cir. 2008) (rejecting dormant Commerce Clause claim based on the asserted “inability to tell where the resident is located during Internet communications” because “this possible extraterritorial effect of the statute” was only “speculation”); Jack Goldsmith & Eugene Volokh, State Regulation of Online Behavior: The Dormant Commerce Clause and Geolocation,101 Tex. L. Rev. 1083
, 1086 (2023) (“A quarter-century ago, the internet seemed to make this vision
[of state-by-state regulation] impossible to preserve. But today, technology can enhance such territorialist pluralism.
Online services can, relatively reliably, determine the state in which a user is located, and their software can then act
differently depending on which state is involved. Such so-called geolocation isn’t perfect; but so long as the law
requires only reasonable attempts at geolocation rather than perfection, the burden on interstate commerce ought not
be excessive.”).
157 See supra n.32. To be sure, steps can be taken to identify a user’s physical location using today’s technology.
Rattray Decl. ¶ 26 (“More precise-seeming signals, such as GPS coordinates, may improve a[] [location] estimate in
some circumstances.”); Kornett Decl. ¶¶ 37, 41 (stating that his proposed method provides a “reliable approximation
of a user’s likely jurisdiction to a reasonable degree of confidence.”); Rattray Supp. Decl. ¶¶ 8, 25–29, 43–46; Collie
Supp. Decl. ¶¶ 29–33. But while the parties heavily dispute the efficacy of this technology, neither represents that
perfection is attainable.
30
compliance with the law without age-verifying all users. Unlike a law that merely increases a
company’s cost of running its business,158 the actual-location provision in practice requires an
entity to perform age verification services for every user visiting its site from any location
because the entity would violate the law if even one of those users happened to be obfuscating
their location from Utah. As a result, the law “cannot effectively be limited” to primarily
regulating those in Utah obfuscating their location “over the Internet because no such
[technology to detect those users in every instance] exist[s].”159
Because the actual-location provision, in most cases, directly regulates an entity’s
interactions with those who have no connection to Utah, it likely creates too much direct
regulation of wholly out-of-state conduct to be lawful under the dormant Commerce Clause.
Utah next argues that the actual-location provision is not a “direct” regulation.160 In
support, Utah points to the Sixth Circuit’s decision in Online Merchants Guild v. Cameron.161 In
Online Merchant Guild, a guild of third-party Amazon sellers brought a Commerce Clause
challenge against Kentucky for its anti-price gouging laws.162 To determine whether the laws
created an impermissible direct regulation, the court considered whether the laws “control[]
wholly out-of-state commerce by its express terms or by its inevitable effect.”163 The Sixth
Circuit found the laws to merely have an indirect effect on out-of-state transactions because “the
158 See, e.g., Pork Producers, 598 U.S. at 371
(“Petitioners further insist that [the challenged law] offends ‘this almost per se’ rule because the law will impose substantial new costs on out-of-state pork producers who wish to sell their products in California.”). 159 ACLU v. Johnson,194 F.3d at 1161
(citation modified). 160 Opp. 30–32. 161 Online Merchants Guild v. Cameron,995 F.3d 540
(6th Cir. 2021). 162Id. at 544
. 163Id. at 553
(citation modified).
31
effect of Kentucky’s price-gouging laws depends entirely upon Amazon’s independent decision
in how it structures its online marketplace.”164 Amazon prohibited sellers from using state-
specific pricing or limiting product availability—a restriction imposed despite the fact that “no
one contend[ed] that Amazon lack[ed] the power to structure its marketplace” in this manner.165
If Amazon did allow for these options, “there would be no effect at all on interstate
commerce.”166 So, although the laws would increase sellers’ national prices, that was only
because the marketplace they sold on structured its business to create a national effect despite
having the choice to limit the effects to just the regulating state.
Online Merchants Guild does not help Utah’s case. Utah argues that the actual-location
provision is indirect because technology “allow[s] Aylo to reasonably and feasibly attempt to age
assure VPN-using Utahns, [so] any decision by Aylo to instead age-verify all users would be a
voluntary business choice, not an effect forced by Utah law.”167 The court does not doubt that
this is the Attorney General’s good faith intention. But, as discussed above,168 the actual-location
provision does not contain a reasonableness or feasibility standard and would therefore impose
liability every time an entity did not perform age verification on a user located in Utah. Unlike
Online Merchants Guild, the nationwide reach of the actual-location provision would not be due
to an entity’s choice on how to structure its business. Rather, it would be “inevitable” that the
entity would need to comply by age verifying every outside-of-Utah user on its site to avoid
liability.
164 Id. at 555
. 165Id.
166Id.
167 Opp. 31–32.
168 See supra Part II.
32
Therefore, Aylo has shown that by requiring perfection the actual-location provision
would regulate a massive amount of wholly out-of-state conduct with no connection to Utah.
Indeed, as discussed further below, the regulation of out-of-state conduct would be the primary
and overwhelming result. This extreme fact pattern likely would violate the dormant Commerce
Clause.
3. Pike Balancing Test
Further, Aylo challenges the actual-location provision under the Pike v. Bruce Church,
Inc.,169 balancing test.170 Under Pike balancing, a plaintiff may prevail in a dormant Commerce
Clause challenge “if it can show that ‘the burden imposed on interstate commerce is clearly
excessive in relation to the putative local benefits.’”171 “[T]he extent of the burden that will be
tolerated will of course depend on the nature of the local interest involved, and on whether it
could be promoted as well with a lesser impact on interstate activities.”172
In considering the interests involved, the court is mindful that “[a] State’s power to
regulate commerce is never greater than in matters traditionally of local concern,” such as
“regulations that touch upon safety.”173 Even so, “[t]he Court has continued to consider the
169 Pike v. Burce Church, Inc., 397 U.S. 137
(1970). 170 As the Tenth Circuit recently noted, “[a]lthough Justice Gorsuch’s opinion in [Pork Producers] questioned the propriety, even the coherence, of balancing incommensurable quantities such as health and economic costs, six justices voted to retain the Pike balancing test.” Green Room LLC v. Wyoming,157 F.4th 1196
, 1210 n.5 (10th Cir. 2025) (citing Pork Producers,598 U.S. at 392
(Sotomayor, J., joined by Kagan, J., concurring in part);id.
at 396–97 (Roberts, C.J., joined by Alito, J., Kavanaugh, J., and Jackson, J., concurring in part and dissenting in part)). 171Id.
at 1210 (quoting Pike,397 U.S. at 142
(emphasis omitted)); see also Pork Producers,598 U.S. at 377
. 172 Green Room, 157 F.4th at 1209 (quoting Pike,397 U.S. at 142
).
173 Id. at 1209 (citation modified).
33
availability of less burdensome alternatives in analyzing Commerce Clause challenges to statutes
that regulate evenhandedly.”174
The actual-location provision likely fails Pike balancing as a result of two unusual factual
considerations: (1) because the amendment requires an unattainable perfection in geolocation, its
primary effect will be to burden interstate commerce outside of Utah; and (2) Utah’s arguments
for a reasonableness standard effectively concede that its interests could be served with a less
burdensome impact on interstate activities.
First, the actual-location provision’s burden on interstate commerce is heavy. In ACLU v.
Johnson, the Tenth Circuit considered New Mexico’s internet law under Pike and concluded that
the law violated the dormant Commerce Clause under the balancing test.175 Based on the
backdrop of a New Mexico law that could not be limited by geography, the Tenth Circuit
concluded that the law posed “an extreme burden on interstate commerce.”176
Here, the actual-location provision poses similar concerns. As an example,177 Aylo has
approximately 28 million active visitors to its sites each month from the United States.178
Because the law requires perfection in the absence of perfect geolocation tools, Aylo would need
to verify those 28 million users—whether located in Salt Lake City, Boston, New Orleans,
Anchorage, or Honolulu—to ensure compliance and avoid liability. Indeed, every entity that
174 Dorrance v. McCarthy, 957 F.2d 761, 764
(10th Cir. 1992); see also U & I Sanitation v. City of Columbus,205 F.3d 1063, 1071
(8th Cir. 2000) (“As Pike directs, our analysis of ‘the nature of the local interest’ must be paired with an examination of the record for . . . less burdensome means to achieve [the] stated purposes.” (citation modified)). 175 194 F.3d at 1161–62. 176Id.
at 1162 (quoting Pataki, 969 F. Supp. at 179). 177 See Quik Payday,549 F.3d at 1309
(noting that Pike balancing “is based on the overall benefits and burdens that
the statutory provision may create, not on the benefits and burden with respect to a particular company,” but also
noting that “evidence regarding a particular company may be suggestive” of the broader burdens).
178 PI Mot. 4; Collie Decl. ¶ 12.
34
hosts material applicable under the actual-location provision would need to age verify all of the
entity’s users nationwide or inevitably violate the law. This reach is expansive and would
involve massive numbers of wholly out-of-state interactions.
Second, the significant local interests served by the actual-location provision can be
achieved through less burdensome means. To be sure, the law involves a substantial safety
interest in preventing minors from accessing harmful sexual material, which falls squarely within
Utah’s traditional regulatory power.179 But Utah has represented that a law requiring “feasible
and reasonable [geolocation] methods,” instead of perfection, would promote the same interests
served by the actual-location provision.180 Because of this unique posture, Utah’s weighty
interests could clearly be “promoted with . . . a lesser impact on interstate activities.”181 Thus,
Aylo has shown that the actual-location provision likely imposes an excessive burden on
interstate commerce in relation to its local benefits.
Although “[s]tate laws frequently survive . . . Pike scrutiny,” this is “not always” the
case.182 Given the law’s massive burden and Utah’s appropriate acknowledgement of the
179 Utah has presented extensive undisputed evidence that such material is harmful to minors. Opp. 9–13. The
regulation of harmful material “touch[es] upon safety” in a matter “traditionally of local concern.” Ginsberg v. State
of N.Y., 390 U.S. 629
, 640–43 (1968). And the Supreme Court has held that “[a state]’s interest in shielding children from sexual content is important, even ‘compelling.’” Free Speech Coalition, Inc. v. Paxton,606 U.S. 461, 496
(2025). 180 Opp. 42; see also Hr’g Tr. 39 (“[Utah’s] law [is] designed to protect minors from the harms of pornography. But all that law asks is that companies that distribute pornographic material online use reasonable methods to verify the age of users in Utah who are trying to access that pornographic material using VPNs.”); Hr’g Tr. 46–47, 49; Opp. ¶¶ 1–24, 70–75. Throughout the briefing and oral argument Utah defends the actual-location provision as simply requiring reasonableness. But, for the reasons discussed supra Part II, the court cannot accept Utah’s interpretation of the statute. 181 See Pike,397 U.S. at 142
. 182 Dep’t of Revenue of Ky. v. Davis,553 U.S. 328, 339
(2008).
35
availability of less burdensome alternatives, this is one of those unusual circumstances where a
state law likely violates the dormant Commerce Clause under Pike balancing.
All in all, Aylo has shown it is substantially likely to succeed on the merits of its claims
that the actual-location provision facially violates the United States Constitution’s dormant
Commerce Clause. Because it has, the court does not reach Aylo’s Foreign Commerce Clause
claim.
IV. Irreparable Harm
Aylo must also show that it “will suffer irreparable injury if the injunction is denied.”183
“The purpose of a preliminary injunction is . . . to protect plaintiffs from irreparable injury that
will surely result without their issuance.”184 “Demonstrating irreparable harm is ‘not an easy
burden to fulfill.’”185
“A plaintiff suffers irreparable injury when the court would be unable to grant effective
monetary remedy after a full trial because such damages would be inadequate or difficult to
ascertain.”186 “An alleged constitutional infringement will often alone constitute irreparable
183 Fish v. Kobach, 840 F.3d 710, 723
(10th Cir. 2016) (quoting Beltronics USA, Inc. v. Midwest Inventory Distrib., LLC,562 F.3d 1067, 1070
(10th Cir. 2009)). 184 DTC Energy Grp., Inc. v. Hirschfeld,912 F.3d 1263, 1270
(10th Cir. 2018) (quoting Schrier v. Univ. Of Co.,427 F.3d 1253, 1267
(10th Cir. 2005)). 185Id.
(quoting First W. Cap. Mgmt. Co. v. Malamed,874 F.3d 1136, 1141
(10th Cir. 2017)). 186 Awad v. Ziriax,670 F.3d 1111, 1131
(10th Cir. 2012) (quoting Dominion Video Satellite, Inc. v. EchoStar Satellite Corp.,269 F.3d 1149, 1156
(10th Cir. 2001)).
36
harm.”187 Particularly relevant here, deprivation of Commerce Clause rights is itself an
irreparable injury.188
Here, by showing a substantial likelihood of success that the actual-location provision
violates the dormant Commerce Clause, Aylo has necessarily established that it will suffer
irreparable harm in the absence of injunctive relief. The court finds this harm sufficient and does
not consider whether Aylo’s other alleged harms are irreparable.189
V. Balance of Equities and Public Interest
“The third preliminary-injunction factor involves balancing the irreparable harms
identified [by Aylo] against the harm that the preliminary injunction causes” to Utah.190 The
“last preliminary-injunction factor requires that the injunction not be against the public
interest.”191 These last two factors merge where “the government is the opposing party.”192
That said, a violation of the constitution “usually trumps any harm to the defendant.”193
There is always a public interest in avoiding a constitutional infringement.194 And although the
“ability of a [government] to enact and enforce measures it deems to be in the public interest is
187 Free Speech Coal., Inc. v. Shurtleff, No. 2:05CV949DAK, 2007 WL 922247
, at *18 (D. Utah. Mar. 23, 2007) (quoting Goldie’s Bookstore, Inc. v. Superior Court,739 F.2d 466
, 472 (9th Cir. 1984)); see also Awad,670 F.3d at 1131
(“[W]hen an alleged constitutional right is involved, most courts hold that no further showing of irreparable injury is necessary.” (quoting Kikumura v. Hurley,242 F.3d 950, 963
(10th Cir. 2001))). 188 See ACLU v. Johnson,194 F.3d 1149, 1163
(10th Cir. 1999) (citing Am. Libraries Ass’n v. Pataki,969 F.3d 160
, 168 (S.D.N.Y. 1997) (“Deprivation of the rights guaranteed under the Commerce Clause constitutes irreparable injury.”); see also Free Speech Coal.,2007 WL 922247
, at *18 (same); Bioganic Safety Brancs, Inc. v. Ament,174 F. Supp. 2d 1168, 1185
(D. Colo. 2001) (same). 189 Cf. Rocky Mountain Gun Owners v. Polis,121 F.4th 96, 128
(10th Cir. 2024) (“Most courts consider the infringement of a constitutional right enough and require no further showing of irreparable injury.” (quoting Free the Nipple-Fort Collins v. City of Fort Collins,916 F.3d 792, 805
(10th Cir. 2019))). 190 Rocky Mountain Gun Owners v. Polis,121 F.4th 96, 128
(10th Cir. 2024) (citation modified). 191Id.
(citation modified). 192Id.
193 Free the Nipple-Fort Collins v. City of Fort Collins,916 F.3d 792, 806
(10th Cir. 2019). 194 See Awad v. Ziriax,670 F.3d 1111, 1132
(10th Cir. 2012) (“[I]t is always in the public interest to prevent the
violation of a party’s constitutional rights.” (citation modified)).
37
. . . an equity to be considered in balancing hardships,”195 “the [state] has no interest in keeping
an unconstitutional law on the books.”196
Aylo principally argues that because there is a public interest in preventing a
constitutional violation and it has shown a substantial likelihood of success on its constitutional
claim, it follows that such an interest makes “the balance of equities . . . lean in [its] favor.”197 In
response to this argument, Utah argues that “Aylo is not likely to succeed on the merits of its
claim.”198 So, Utah asserts, “because there is no constitutional violation, the balance of equities
and public interest do not tilt in Aylo’s favor.”199
The court agrees with Aylo. Because Aylo has shown a substantial likelihood of a
constitutional violation and irreparable harm from that violation, “it follows that the balance of
equities and the public interest” are in its favor.200 After all, the “likelihood-of-success and
irreparable-harm factors are ‘the most critical’ in the [preliminary injunction] analysis.”201 The
harm of a constitutional violation is greater than Utah’s interest in enforcing a statutory provision
that likely is unconstitutional. Aylo has therefore satisfied the third and fourth factors for a
preliminary injunction.
195 Heideman v. South Salt Lake City, 348 F.3d 1182, 1191
(10th Cir. 2003). 196 Free the Nipple-Fort-Collins,916 F.3d at 806
; cf. Awad,670 F.3d at 1131
(“[W]hen the law that voters wish to enact is likely unconstitutional, their interests do not outweigh [a plaintiff’s interest] in having his constitutional rights protected.”). 197 PI Mot. 25 (quoting NetChoice, LLC v. Reyes,748 F. Supp. 3d 1105
, 1131 (D. Utah 2024)). 198 Opp. 51. 199 Id. 200 NetChoice, LLC, 784 F. Supp. 3d at 1131. 201 Rocky Mountain Gun Owners,121 F.4th at 112
(quoting Nken v. Holder,556 U.S. 418, 434
(2009)).
38
In sum, because Aylo has satisfied all four preliminary injunction factors, it has
established a “clear and unequivocal” right to the extraordinary relief of a preliminary
injunction.202
VI. Scope of Injunction
One final item bears noting. Aylo’s Complaint and Motion expressly disclaim any
challenge to the age verification provision. Consistent with that averment, neither Aylo’s
Complaint nor its motion offer any challenge to Utah Code section 78B-3-1002(1)(a). But
despite the disclaimer and the lack of any argument against that provision, the Complaint’s
Prayer for Relief and the proposed Preliminary Injunction unexpectedly ask not only that the new
amendment—Utah Code section 78B-3-1002(3)—be enjoined, but that the court also enjoin
Defendants “from enforcing Utah Code § 78B-3-1002(1)(a) against Plaintiffs and their affiliates
in connection with any individual whose location appeared to Plaintiffs and their affiliates to be
outside the State of Utah.”203 This relief cannot be granted. Aylo cannot state that section 78B-3-
1002(1)(a) “is not at issue in this case,” and then ask the court to enter an injunction involving its
application.
CONCLUSION
Read together with the age verification statute as a whole, the actual-location amendment
requires entities like Aylo to geolocate its website users with perfection to avoid liability. It is
undisputed that geolocation perfection is not presently possible. In defending the amendment, the
Attorney General has represented that Utah would only apply a reasonableness standard to
202 See id. at 112 (quoting Dominion Video Satellite, Inc. v. Echostar Satellite Corp., 356 F.3d 1256, 1261
(10th Cir.
2004)).
203 Complaint 26; Plaintiffs’ Proposed Order Granting Preliminary Injunction 2, ECF No. 3-8, filed April 22, 2026.
39
enforcement of the required geolocation efforts. And Aylo has stated that if the amendment were
written the way the Attorney General defends it, “we would not be here.”?”4 In the end, the
statute says nothing about reasonableness in geolocation efforts, and the court is required to
analyze the statutory text the Legislature passed into law, not just the Attorney General’s
proposed enforcement of it. As a result, the actual-location provision must be enjoined.
ORDER
Plaintiffs’ Motion for a Preliminary Injunction*” on the actual-location provision, Utah
Code section 78B-3-1002(3), is GRANTED.
Signed September 24, 2026.
BY THE COURT
Qc
DavidBarlow
United States District Judge
204 Reply 1.
205 ECF No. 3.
40