Law / United States / 
Utah
SB 287 (2023), Online Pornography Viewing Age Requirements, as amended by SB 73 (2026), Online Age Verification Amendments
In force since , under challenge in court.
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- Verify that Utah visitors are 18 or older using a digitized identification card, an independent third party age verification service, or a commercially reasonable method relying on transactional data.
- Treat a visitor actually located in Utah as accessing the site from Utah, and so subject to age verification, even when the visitor connects through a virtual private network (VPN).
- Pay a 2 percent excise tax on your covered content revenue from .
These lines are LexLint's reading of the law's text. Also read by: Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340-DBB-JCB (D. Utah ) (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Administrative fine or court-ordered civil penalty of up to $2,500 per violation, imposed by the Division of Consumer Protection or a court since SB 73 (2026) added Division enforcement; a separate civil penalty of up to $5,000 per violation applies to violating an administrative or court order.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
Originally private civil liability only; since SB 73 (2026), also the Utah Division of Consumer Protection, which administers and enforces the chapter with administrative fines and court actions.
Litigation
- Court
- U.S. Court of Appeals for the Tenth Circuit; U.S. District Court for the District of Utah
- Docket
- Free Speech Coalition, Inc. v. Anderson, No. 23-4104 (10th Cir. 2024) (challenge to the original 2023 law); Aylo Freesites Ltd. v. Utah Division of Consumer Protection, No. 2:26-cv-00340 (D. Utah) (challenge to the 2026 amendment)
- Posture
- The original 2023 law's challenge was dismissed on Eleventh Amendment immunity grounds because the law relied on private enforcement, affirmed by the Tenth Circuit on . In Aylo's challenge to the 2026 amendment, filed , the District of Utah granted a preliminary injunction on against the actual-location provision, section 78B-3-1002(3), which applies the age verification requirement to an individual actually located in Utah even when a virtual private network, proxy server or other means makes the individual appear to be elsewhere. The order does not reach the age verification requirement itself, which Aylo did not challenge.
Settledness
The order enjoins the actual-location provision, section 78B-3-1002(3), and does not reach the age verification requirement of section 78B-3-1002(1)(a).
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-utd-2_26-cv-00340/pdf/USCOURTS-utd-2_26-cv-00340-0.pdf
- Case citation
- Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340-DBB-JCB (D. Utah )
- Under challenge
- Yes
- Open questions
- What geolocation effort satisfies Utah Code section 78B-3-1002(3) for an entity that must treat a user as accessing the site from Utah when the user is actually located there, given that the court found the statute says nothing about reasonableness and the Attorney General represented that only a reasonableness standard would be applied?
What it reaches
Age threshold
18
Covered services
Commercial entities for which a substantial portion (more than one third) of website content is pornography or other material harmful to minors.
How the hook was established
express
What makes it apply
User location
Obligation class
Age verification, Retention
Verification methods
Digital ID, Third party service, Transactional data
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- "Substantial portion" means more than 33-1/3% of total material on a website, which meets the definition of "material harmful to minors" as defined in this section
What it makes you log
Log retention
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Identifying information of the individual whose age was verified, which neither the commercial entity nor a third party may retain after access has been granted to the material
Logging duty
Section 78B-3-1002, as amended by SB 73 (2026) and read in the current code, requires a commercial entity to perform reasonable age verification (subsection (1)) and bars it and any third-party verifier from retaining identifying information after access has been granted (subsection (2)). It names no log, no record of the check, no retention period and no regulator access to a record.
- Kind
- None
- As of
What this law does
Makes a commercial entity that publishes material harmful to minors on a website where more than one third of total material is harmful to minors civilly liable if it fails to verify that Utah visitors are 18 or older using a digitized identification card, an independent third party age verification service, or a commercially reasonable method relying on transactional data.
SB 73 (2026) added Division of Consumer Protection enforcement effective , a rule treating a user as accessing the site from Utah even through a virtual private network (VPN), and a 2 percent excise tax on covered content revenue effective that funds youth mental health programs and enforcement.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .