A federal judge in Utah has temporarily halted one of the most aggressive state efforts yet to pierce the privacy protections that VPNs provide, even as a federal appeals court in New York has handed border agents broader authority to search travelers' phones without suspicion. Together, the two rulings this month capture a widening fault line in American law: the tension between a government's stated interest in safety and the technical reality of how encryption, location-masking, and data storage actually work. Both cases matter well beyond their immediate facts, because both involve courts being asked to referee technology they are still learning to understand.
The Utah dispute centers on a 2026 amendment to the state's age-verification law for adult websites, which tried to close what lawmakers saw as a loophole: residents using a VPN to make it look like they were browsing from another country. Aylo, the parent company of several major adult platforms, challenged the law's "actual-location" provision, arguing it would force every site to verify the age of literally every visitor worldwide, just to catch the Utah residents hiding behind a VPN. The irony is hard to miss. The same privacy tool that lets a software engineer continue working remotely from another country while keeping sensitive corporate traffic encrypted is treated, in this statute, as a loophole to be closed rather than a legitimate security practice to be protected. working remotely from another country
Why the Dormant Commerce Clause Did the Heavy Lifting
The U.S. District Court for the District of Utah did not rule that age verification itself is unconstitutional. It ruled narrowly that the "actual-location" language went too far, because the statute's text demanded certainty about a user's physical location that no technology can reliably deliver. Courts cannot rewrite a law's plain words to make it more defensible, and Utah's drafters had written "actually located," not "reasonable efforts to determine location." That distinction, the court found, meant websites would have to impose age checks on visitors everywhere, from Paris to Tokyo, to avoid missing a single Utah resident. The burden on interstate and global commerce outweighed the state's local interest, triggering the Dormant Commerce Clause and producing a preliminary injunction. The underlying age-verification mandate survives; only the location-tracking provision is paused, and Utah retains the option to rewrite and refile.
The Border Exception Gets Wider
Meanwhile, the Second Circuit's decision in U.S. v. Alisigwe moves in the opposite direction for digital privacy. The court held that a manual, scroll-through search of a traveler's phone at the border counts as "routine," meaning officers need no reasonable suspicion at all to conduct it. That ruling directly contradicts several prior district court decisions in New York, which had found that phones contain such a volume of personal data that searching one should require at least a warrant. The Second Circuit rejected that reasoning outright, arguing that the sheer amount of information on a device only strengthens the government's interest in inspecting it. The court left open whether forensic searches, those that copy and extract data using specialized software, deserve different treatment.
What Travelers and Privacy-Conscious Users Should Take Away
For now, non-citizens who refuse to unlock a device at the border risk detention, while citizens can decline but should expect the device to be seized. Oversight has not been reassuring either: investigators have found that border authorities failed to properly track or dispose of privileged material collected under prior device-search policies. The practical lesson is the same one running through both rulings this month: privacy tools and legal protections are only as strong as the specific language and oversight behind them, and both are being tested in real time.