Your age verification is careful. You chose a method, you measured it, you kept the decision record, you can tell a regulator what threshold you used and when the policy version changed.
Now look at the line of code that decides whether any of that runs. It is probably an IP lookup in a middleware file, written during the first state-law sprint, returning a two-letter string. Nobody has reviewed it since. It has no confidence score, no fallback, and it writes nothing down.
On 24 September 2026 that asymmetry became a legal question. In Aylo Freesites Ltd v. Utah Division of Consumer Protection (D. Utah, No. 2:26-cv-00340-DBB-JCB), Judge David Barlow granted a preliminary injunction against the provision of Utah’s SB 73 that extended age verification duties to anyone “actually located” in Utah, whether or not they were using a VPN or a proxy to hide it.
The headlines read as a win for Aylo and a loss for Utah. The useful part is the reasoning, because it is an engineering argument that a court accepted, and it applies to every platform that gates by geography.
The two clauses that did not match
Utah’s statute has an age clause and a location clause, and they are written to different standards.
The age clause, Utah Code § 78B-3-1001(11), defines “reasonable age verification methods” and includes a digitised identity document, a third-party verification service, or “any commercially reasonable method”. That is a standard with give in it. You pick a method, you can defend the choice, and the question a court asks is whether the choice was reasonable.
The location clause, § 78B-3-1002(3), says an individual accesses the site from Utah if they are “actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location.”
There is no “reasonable” in that sentence. There is no “commercially reasonable efforts to determine”. There is a fact about the world, and liability attaches to getting it wrong.
Utah’s lawyers argued in court that of course a reasonableness standard would apply in practice. The judge declined to read one in. From the opinion: “The statute says nothing about reasonableness in geolocation efforts, and the court is required to analyze the statutory text the Legislature passed into law, not just the Attorney General’s proposed enforcement of it.”
That left strict liability. And strict liability for a fact you cannot determine has only one compliant implementation.
The number that decided the case
If you cannot tell who is in Utah, and you are liable for everyone in Utah who gets through, the only safe behaviour is to verify everybody.
Aylo put numbers on that. About 86% of its traffic comes from outside the United States. To be sure it had caught every Utah user, it would have to run age verification against roughly 28 million monthly United States visitors, and arguably against the rest of the world too.
The court used this for the dormant Commerce Clause analysis and found the burden “clearly excessive in relation to the putative local benefits”. It also found direct regulation of wholly out-of-state conduct, following ACLU v. Johnson, because the law “cannot effectively be limited” to Utah users when no technology exists to identify them in every instance.
Notice what did the work. Not a First Amendment argument about adults’ access to lawful speech. An argument about the error rate of a geolocation stack, and what a legislature is allowed to do when it ignores one.
Both sides agreed the technology does not work
This is the part worth reading twice, because it is rare for a court to put it so plainly.
From the opinion: “The law requires geolocation perfection, but the parties agree that current technological advancements do not allow an entity to perfectly (1) detect VPN/proxy users, or (2) geolocate where all of those VPN/proxy users are accessing the site from.”
The court went through the methods available. Commercial VPN and proxy detection services. Non-IP indicators like device timezone, browser language, currency preference and request headers. Device location requests. Historical account activity. Its finding on all of them: they are “both under and over inclusive and subject to manipulation”.
Utah’s own experts proposed a three-step detection method and conceded it would not find every Utah user. The parties fought hard over the percentages. Neither claimed 100%.
So a United States district court has now written down, as a finding supported by both sides’ experts, that geolocation is probabilistic. Your product schema almost certainly disagrees. In most codebases the user’s country is a string, not a distribution, and the code that consumes it has no branch for “we are not sure”.
Why this is your problem even if you do not operate in Utah
Count the age assurance obligations you are currently tracking. Every one of them has a geographic trigger.
The UK Online Safety Act applies to services with links to the United Kingdom. Australia’s under-16 rules apply to Australian users. The Digital Services Act applies to recipients in the Union, and the KIDS Act proposal will apply to the same population with four age states instead of one. More than twenty US states have their own thresholds, their own definitions and their own patchwork of trigger conditions.
Each of those obligations fires off the same unreviewed lookup. You have spent two years making the age half defensible and left the trigger half as a lookup table from a vendor you have not re-evaluated since the integration.
The Utah ruling does not say your geolocation has to be perfect. It says the opposite. But it says it in a way that creates a new expectation: if the standard is reasonableness, then reasonableness is a thing you have to be able to show. And you cannot show a decision that was never recorded.
What a location decision record looks like
You already keep a decision record for the age check. Method, threshold, confidence, policy version, timestamp, outcome. The fix here is to keep the same record for the location call, because it is the same class of decision.
A usable record has six fields.
The verdict. Which jurisdiction set you concluded applied, as a list, not a single country. A user can be inside the scope of two regimes at once.
The confidence. A number, not a boolean. Your IP vendor already returns one and you are almost certainly throwing it away.
The signals used, and whether they agreed. IP country, proxy or hosting-range flag, device timezone offset, Accept-Language, billing country if you have one, prior sessions on the same account. Disagreement is information. An IP in Frankfurt with an America/Denver timezone and an English-US locale is a different situation from an IP in Frankfurt with a Europe/Berlin timezone, and only one of those is worth a step-up.
The policy version. Which rule set made this call. When you change the thresholds you need to know which users were decided under which version.
The action taken. Verified, allowed, step-up prompted, blocked.
The timestamp. Location is a property of a session, not of an account. Someone who verified in Berlin in March is a different compliance question in September.
That record costs you a row. It is the only thing that turns “we made a reasonable effort” from a claim into evidence, and the Ofcom enforcement pattern has already shown that the claim alone does not survive an information request.
The asymmetry that should set your thresholds
Here is the arithmetic that most teams never do explicitly, which means it gets decided by accident in a middleware default.
A false positive on location means you ask someone in Berlin to pass a Utah-grade age check. The cost is a friction event: some abandonment, some annoyance, a support ticket if the flow is bad. Measurable, recoverable, and priced per unit.
A false negative means a Utah user walked past the gate. The cost is a statutory penalty, a private right of action in several states, and a finding that your reasonable efforts were not reasonable.
Those two costs are not within an order of magnitude of each other. So the correct design biases heavily toward over-inclusion, and the only real constraint is what over-inclusion costs you per check.
Which is why the pricing of the check is a compliance variable and not just a line item. If confirming a returning user costs you the same as a full document verification, you will set the geographic ring tight to control spend, and you will set it tight for budget reasons while telling a regulator you set it on risk. If the returning-user check is cheap, you can widen the ring until the cost of being wrong about location stops mattering.
Run it on your own numbers before you design the trigger logic. It usually changes the design.
Three rings, not one line
The practical shape that falls out of this is a ring model rather than a country match.
Inner ring: high confidence in scope. IP, timezone and locale agree, no proxy flag, account history consistent. Apply the jurisdiction’s full requirement. This is most of your traffic and it behaves exactly as it does today.
Middle ring: contested. Signals disagree, or the IP sits in a hosting or VPN range, or the user is one hop from a regulated jurisdiction. Do not block, and do not silently treat them as out of scope. Apply the stricter of the candidate regimes, or run a cheap returning-user check that resolves the question without a document upload. Log the disagreement.
Outer ring: confidently out of scope. Nothing to do, but write the row anyway. The row is what proves you looked.
The ring model also gives you something a country string cannot: a measurable middle. You can report “4.1% of sessions were contested last month, we applied the stricter regime to all of them, here is the breakdown”. That sentence is an answer to a regulator’s question. “We use a geo-IP provider” is not.
What not to do with this ruling
Do not read it as permission to stop trying. The injunction removed a strict liability provision. It left the underlying requirement, including the original duty to block known Utah IP addresses, fully in force. Doing less than you did last week is not the lesson.
Do not treat VPN users as a hostile class. Corporate VPNs, privacy tooling, mobile carrier CGNAT and travel all produce the same signal. Circumvention is a measurable behaviour, not a moral category, and a design that punishes everyone behind a tunnel will fail your adult users far more often than it catches a minor.
Do not exit the market. Leaving a jurisdiction does not retire liability for the period you served it, which is the whole lesson of the Fapello penalty. A geoblock added after the duty attached is an admission with a timestamp on it.
The honest limits
This is a preliminary injunction from one federal district court, on a likelihood-of-success standard, not a final judgment. Utah can appeal, and the Tenth Circuit may see the Commerce Clause question differently. The court expressly declined to reach the foreign Commerce Clause claim and rejected Aylo’s extraterritoriality argument, so this is a narrower win than the coverage suggests.
It also binds nobody outside Utah. Most other state age verification statutes do contain reasonableness language in their location provisions, which is exactly why they are not being struck on this ground. If your legal team reads your exposure as unchanged, they are probably right about the law.
The engineering point survives either way. A court has made a finding of fact that geolocation is imperfect, and the standard being applied to you is reasonableness. Both of those statements are about evidence, and evidence is a product decision made months before anyone asks for it.
Nothing here is legal advice, and a platform operating across several of these regimes should get a view on its own facts.
How Xident fits
Location belongs in the decision record, next to the age. Every Xident check returns outcome, method, threshold, confidence, policy version and timestamp. The same record carries the jurisdiction set the call was made under, so the question “why did this user get a document check and that one did not” has an answer that does not require reading application logs.
Cheap returning-user checks are what make a wide ring affordable. This is the arithmetic from the section above, with our numbers in it. A document Verification on Growth is €0.20. A Check, which covers the returning-user path, the browser age check and an existing Xident ID lookup, is €0.02. Suppose 3% of your 2 million monthly sessions land in the contested middle ring. That is 60,000 Checks. On Growth, with 30,000 included and post-paid metering beyond, the contested ring costs about €600 a month. Running a document Verification on the same population would cost €12,000. The ring gets wider when the check gets cheaper, and that is a procurement decision disguised as an engineering one. Current rates are on the pricing page.
No hard stop on the paid metered tiers. Starter, Growth and Scale meter past the included volume rather than stopping, so a traffic spike in a contested region does not turn your age gate off. Basic is the exception and stops at its boundary by design.
A returning user does not repeat a document upload. If the contested ring catches someone you have already verified, the resolution is a Check against their existing Xident ID, not a second scan of their passport.
The free sandbox grants 1,000 Checks and 100 document Verifications as one-time allowances rather than a monthly quota, which is enough to model a three-ring trigger against your own traffic shape before you commit to thresholds.
The short version
Utah wrote an age clause that said “commercially reasonable” and a location clause that said nothing. A judge read the silence as strict liability, both sides’ experts agreed perfect geolocation does not exist, and the provision went down on 24 September.
The standard you are actually held to is reasonableness, in Utah and nearly everywhere else. Reasonableness is a thing you prove, and you prove it with a record. Treat the location call the way you already treat the age call: multiple signals, a confidence number, a defined action for the contested middle, and a row written every time.
You have been treating country as a fact. A federal court has now written down that it is an estimate.
Xident provides age and identity verification infrastructure with decision records in place of retained documents, and a returning-user Check priced an order of magnitude below a document Verification so that widening your in-scope ring stays affordable. The free sandbox includes a one-time allowance of 1,000 Checks and 100 document Verifications. Talk to us about making the trigger half of your age gate as defensible as the age half.
