Indiana Sues Porn Sites, Says Geoblocks Aren’t Enough — State Wants VPNs Blocked Too

Indiana Attorney General Todd Rokita has filed a lawsuit against Aylo, the parent company of Pornhub and several other adult sites, alleging the company violated the state's new age-verification law (Senate Bill 17). The state asks a court for injunctive relief, civil penalties, and reimbursement of investigative costs, arguing that Aylo's decision to geoblock Indiana IP addresses is not sufficient because users can evade those blocks using VPNs and other anonymity tools.

What the Lawsuit Alleges

According to the complaint, investigators from the Office of the Indiana Attorney General were able to access Pornhub and multiple other adult sites from within Indiana by using virtual private networks (VPNs) that presented out-of-state IP addresses. The suit contends that because some Indiana residents can bypass location-based restrictions, geoblocking alone does not comply with the state's age-verification requirements. The complaint also invokes Indiana's Deceptive Consumer Sales Act, claiming Aylo misled consumers about the effectiveness of its geoblock.

Aylo's Response and Critics

An Aylo spokesperson told AVN that the company's restrictions on Indiana access mean it is compliant with the law. Privacy advocates and technology experts, including the Electronic Frontier Foundation, strongly disagree. David Greene of the EFF called the state's approach "quite ridiculous," saying the complaint would hold companies liable for failing to prevent an "impossibility"—blocking every conceivable method users might employ to evade a geoblock.

"What the state's lawsuit seems to be doing is saying that Aylo deceived Indiana consumers when it said it was geoblocking Indiana users from its sites when it knew that VPN users might be able to evade that geoblock," said David Greene of the EFF.

Broader Legal And Policy Context

The Indiana case arrives amid a broader national debate over age verification, content moderation, and online privacy. Federal courts recently blocked similar state measures: a federal court permanently enjoined Louisiana's age-verification law and issued a preliminary injunction against an Arkansas law targeting platform algorithms and youth harms. Those rulings cited constitutional concerns, including protections for free expression and the difficulty of conditioning access to speech on intrusive verification measures.

Critics warn that forcing websites to block VPNs or other privacy tools would undermine legitimate uses of those technologies—remote work access, campus networks, and safe communication channels for people living under repressive regimes. They also argue it would expand state surveillance powers and erode ordinary users' privacy for minimal gain in preventing minors from finding restricted content.

Potential Implications

If courts allow Indiana's logic to stand, it could empower states to pressure platforms and app stores to disable or detect anonymity tools more broadly. That raises constitutional and practical questions about enforceability, overbreadth, and collateral harm to users who rely on privacy tools for legitimate reasons.

The lawsuit against Aylo is likely to become part of ongoing litigation over how far states may go to regulate online speech, protect minors, and require platforms to police access. Observers say the case could set important precedents about the limits of state power over online platforms and about whether blocking widely used privacy measures is legally or practically viable.

Case Status: The suit seeks injunctive relief and penalties; litigation is pending and will likely intersect with other federal and state decisions on similar laws.