Aylo Rebuts Indiana Av Suit Claims Over Vpn Access

As XBIZ reported in December, Attorney General Todd Rokita filed the complaint contending that IP address restrictions implemented by Pornhub and other Aylo sites “are insufficient to comply with Indiana’s Age Verification Law because Indiana residents, including minors, can still easily access the Defendants’ websites with a VPN IP or proxy address from another jurisdiction or through the use of location spoofing software.”

In moving to dismiss the case, Aylo asserted in its supporting brief, among other arguments, that the state’s interpretation and application of the age verification law (AVL) violates the First Amendment, the Due Process Clause and the Commerce Clause.

“Plaintiff takes the position that website operators cannot avoid violating the AVL by blocking Internet traffic from Indiana IP addresses unless those technological restrictions also prevent users from circumventing the geoblocks through VPNs routing traffic through IP addresses associated with other states,” Aylo’s brief reads. “But the AVL contains no such requirement.”

According to the complaint, investigators working for Rokita’s office accessed Pornhub and other Aylo sites from Indiana using a VPN with a Chicago IP address. The fact that they were then able to view adult content on Aylo sites, the complaint argues, indicates that those sites “lacked any reasonable form of age verification.”

Aylo contends that no IP addresses associated with Indiana have been permitted to directly access its websites since the company began geoblocking Indiana in response to the AV law, and decries Indiana’s use of “technological subterfuge” to circumvent the company’s geoblocking measures.

“The statute mandates only ‘reasonable age verification’ — not technologically infallible measures that anticipate and defeat every possible user circumvention tool,” the company’s brief argues.

The Aylo brief frames geoblocking as fitting the ‘reasonable’ requirement, calling it “a widely recognized, industry-standard method of geographic access control used by major streaming and content platforms worldwide.”

For this reason, the Aylo brief states, Indiana’s claims burden the company’s exercise of free speech substantially more than is necessary in order to protect minors under the state’s AV law. Such a burden would constitute a violation of the standard set in Free Speech Coalition v. Paxton, the pivotal case that declared state AV laws constitutional so long as they pass “intermediate scrutiny.” Aylo contends that Indiana’s interpretation of its AV fails to satisfy intermediate scrutiny, and therefore violates the First Amendment.

Aylo also argues in its brief that Indiana’s interpretation of its AV law violates the 14th Amendment’s Due Process Clause by applying the law outside of the state without notice, thus rendering the statute “unconstitutionally vague.”

Finally, Aylo’s brief argues that Indiana’s interpretation of its AV law violates the Commerce Clause of the U.S. Constitution because it seeks to regulate conduct in other states.

“To comply with Plaintiff’s interpretation of the AVL, a publisher, such as Aylo Freesites, would need to impose age verification nationwide, and perhaps worldwide, so as to account for the possibility that an Indiana resident might use a VPN to disguise their location as from another jurisdiction,” the brief reads, noting that such an interpretation “impermissibly extends Indiana law beyond its territorial boundaries.”

The brief also argues that the court lacks jurisdiction in the matter, since the state’s claim of jurisdiction is based on the premise that “some Indiana residents may be able to circumvent Aylo Freesites’ restrictions to access adult content on the freesites via VPNs or proxy servers.” Aylo asks the court to reject this premise, since the company geoblocked IP addresses associated with the state specifically to avoid doing business in the jurisdiction.

The Aylo brief also rejects the state’s claim that Aylo violated the state’s Deceptive Consumer Sales Act by claiming that its IP-address-based blocking of Indiana residents constitutes compliance with Indiana’s AV law. The brief asserts that the state merely “hurls a word salad of accusations” while failing to allege any actual consumer transaction or conduct that violates the DCSA.

The Indiana case reflects growing concern about the widespread use of VPNs to circumvent age verification, which has inspired both state and federal efforts to close that practical loophole.

• In Utah, a bill that would make adult sites liable if minors circumvent geolocation has passed the Utah state legislature and will soon head to the office of Gov. Spencer Cox for signature or veto.
• In Ohio, a bill labeled the “Innocence Act” includes language that would require adult sites to “utilize a geofence system maintained and monitored by a licensed location-based technology provider” to dynamically monitor a user’s physical location and ascertain whether the user is located in the state, and thereby subject to age verification.
• The Kids Internet and Digital Safety (KIDS) Act, which would make age verification by adult websites federal law, includes a provision requiring sites to take “reasonable measures” to address circumvention of age verification.

The state of Indiana has until April 10 to respond to Aylo’s motion to dismiss.