A federal judge in Utah has pumped the brakes on a state law that would have forced adult websites to verify the age of every visitor on Earth, not just those within Utah's borders. The ruling arrives the same month the Second Circuit handed down a decision narrowing travelers' privacy rights at the border, and together the two cases sketch the current battle lines over digital privacy in American courts. This edition of Decrypting a Defense walks through both decisions and closes with five questions for a leading scholar of police surveillance technology.
Utah's VPN Crackdown Hits a Constitutional Wall
The dispute began with Utah's 2023 age-verification law for adult content sites, which was amended this year to add an "actual-location" provision. That clause said a person counts as being in Utah if they are physically present there, "regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent" their location. Aylo, the parent company of several major adult-content platforms, sued, arguing that no technology can pinpoint a user's physical location with certainty, particularly once a VPN enters the picture - a concern that has pushed many ordinary users toward tools like a vpn subscription simply to keep their browsing private rather than to evade any particular law. Because the provision lacked any "reasonable efforts" language, Aylo argued it would have to verify the age of every visitor worldwide just to catch the Utah residents hiding behind a VPN.
The court agreed that this likely violates the Dormant Commerce Clause, which bars states from imposing undue burdens on interstate and international commerce. Utah countered that detection technology exists and that the statute only demanded reasonable efforts - but the text said "actually located," not "reasonably believed to be located," and judges generally will not rewrite a statute to rescue it from its own wording. The injunction blocks only the actual-location clause; the underlying age-verification requirement stands, and Utah may yet rewrite the law to survive scrutiny. The episode is a reminder that VPNs remain one of the few practical tools ordinary people, journalists, and dissidents have to control what their internet traffic reveals about them, and that laws aimed at platforms can end up reaching far beyond the state that passed them.
The Second Circuit Narrows Phone Privacy at the Border
Border searches have long operated under looser rules than searches elsewhere in the country, on the theory that the government's interest in controlling who and what enters the United States outweighs the individual's expectation of privacy. Courts have traditionally split these searches into two types: "routine" searches, such as checking luggage, which need no justification, and "nonroutine" searches, such as strip searches, which require at least reasonable suspicion. The question for the digital age has been where a phone search fits.
In United States v. Alisigwe, the Second Circuit held that a manual search - an officer simply scrolling through a device without forensic software - counts as routine and needs no suspicion at all. The court explicitly rejected contrary rulings from the Southern and Eastern Districts of New York, which had found that phone searches are nonroutine and require a warrant given how much personal data a phone can hold. The Second Circuit turned that logic on its head, reasoning that the sheer volume of personal information on a phone makes it more useful to border enforcement, not less subject to search. The decision left forensic, data-extracting searches unaddressed, leaving that question for a future case.
What Travelers Should Know
Oversight has not kept pace with practice. Customs and Border Protection says privileged attorney-client material will be purged from seized devices absent a security threat, but the agency's own inspector general found it failed to consistently follow that protocol under an earlier policy. Non-citizens who refuse to unlock a device risk detention; citizens can refuse but should expect the device to be seized. Travelers carrying sensitive data should weigh in advance which devices and accounts truly need to cross the border at all.
Five Questions for Andrew Guthrie Ferguson
Our guest this month, George Washington University law professor Andrew Guthrie Ferguson, traces his interest in surveillance technology to a public defender's frustration: officers repeatedly justified stops by citing a "high-crime area" with no data to support the label. That early challenge to unsupported claims grew into decades of scholarship on how predictive policing, facial recognition, and other data-driven tools reshape the balance between police power and constitutional rights - a balance this month's court decisions show is still very much being negotiated in real time.