Indiana Sues Aylo for Violating AV Law by Not Blocking VPN Use

INDIANAPOLIS—Indiana Attorney General Todd Rokita, a Republican, announced today that his office sued Aylo, its affiliated companies, and the ownership group Ethical Capital Partners for allegedly violating the state's age verification laws due to failures to block users using virtual private networks (VPNs).

Aylo is the parent company of Pornhub and other free and premium adult websites. AVN confirmed with an Aylo spokesperson that all IP addresses in Indiana are still blocked, as the company chose to withdraw from the state's digital space to comply with a sweeping age verification measure that took effect earlier this year.

"We know for a fact, from years of research, that adolescent exposure to pornography carries severe physical and psychological harms," Rokita said in a press statement from his office.

"It makes boys more likely to perpetrate sexual violence and girls more likely to be sexually victimized. Yet, despite such realities, these defendants seem intent on peddling their pornographic perversions to Hoosier kids," Rokita continued, justifying why his office brought the lawsuit. But he buried the lead, so to speak.

In the legal complaint filed in a state court that AVN reviewed, Rokita is proposing a legal theory that places blame on Aylo for failing to block all access from Indiana, even when the IP address is spoofed by a VPN or proxy server to appear outside the state's regulated digital space.

Effectively, Rokita is blaming the existence of VPNs on the market as a direct pipeline for minors to access content that would otherwise be blocked due to Indiana's AV regulations.

Corey Silverstein, an attorney who represents adult industry clients, told AVN that this lawsuit is not only unsurprising but extremely problematic.

"It was just a matter of time before one of these state Attorneys General tested this theory," Silverstein noted. "We are going to monitor the case very carefully."

He added, "I see substantial roadblocks for the government's case, but, again, I'm not surprised because the states have been emboldened by the Supreme Court decision in Free Speech Coalition v. Paxton. Going after a VPN service provider would be a stretch, and Section 230 [of the Communications Decency Act of 1996] would stop it.

"That's a dangerous concept, though, because what's next? Power companies? Landlords that lease data center space?"

The legal case presented in the complaint is very flimsy, to say the least.

"As of the date of this filing, defendants’ websites (Aylo) identified above restrict access by users whose devices purport to be in Indiana," argues Rokita in the lawsuit.

"These restrictions are based on the IP address associated with that device. Rather than implement a reasonable age verification method, defendants’ websites display a message when a user with an Indiana IP address attempts to access the website, stating 'We have made the difficult decision to completely disable access in Indiana.'"

The lawsuit justifies, "These restrictions based on IP address, which only apply to IP addresses in states like Indiana with age-verification laws, are unreliable and do not prevent minors in Indiana from accessing sexually explicit material.

"Defendants’ putative IP address restrictions are insufficient to comply with Indiana’s Age Verification Law because Indiana residents, including minors, can still easily access the defendants’ websites with a VPN IP or proxy address from another jurisdiction or through the use of location spoofing software."

A common argument by opponents of age verification laws is that such laws are essentially useless because VPNs can be used to circumvent content blocks.

"Aylo has restricted access to its platforms for users in Indiana, and in doing so, is fully compliant with the law," said an Aylo spokesperson. "On the other hand, there are thousands of adult platforms, including some of the world's largest, that remain freely accessible in Indiana, and are therefore non-compliant.
 
"The data clearly demonstrate that verifying age at the device level is the most effective way to prevent underage people from accessing adult content," the spokesperson added, declining to comment further except to say, "We look forward to the facts being fully and fairly aired in that forum."
 
"What the state’s lawsuit seems to be doing is saying that Aylo deceived Indiana consumers when it said it was geoblocking Indiana users from its sites when it knew that VPN users might be able to evade that geoblock," shared David Greene, the civil liberties director and senior staff attorney for the Electronic Frontier Foundation (EFF). EFF has long opposed regulations on VPNs and age-verification laws, calling such efforts violations of privacy rights and civil liberties for online users.
 
"[This] is quite ridiculous," he shared. "It essentially bases liability on the failure to accomplish impossibilities. And it offers perverse incentives — essentially requiring Aylo to openly inform Indiana consumers about all of its known vulnerabilities."
 
Rokita is also trying to hold Aylo accountable for allegedly violating the state's Deceptive Consumer Sales Act.
 
He alleges Aylo made "false and misleading statements regarding the accessibility of the pornographic websites by Indiana residents," and charges the company with "misleading consumers about their alleged hosting of child sexual abuse material (CSAM) and nonconsensual material (NCM)."
 
Rokita also references in the filing highly disputed and unreliable "undercover news reporting" by far-right influencer Arden Young of Sound Investigations.
 
Young and the Sound Investigations, an outfit spun off from the hard-right Project Veritas group, went viral in the fall of 2023 for getting current and former employees of Aylo, formerly known as MindGeek, on undercover camera, providing remarks about their employer, often from positions of being misinformed or disinformed.
 
AVN additionally reported on how 26 predominantly Republican state attorneys general, including Rokita, issued a letter to Aylo and Ethical Capital Partners threatening legal action for a supposed and non-existent "moderation loophole," citing the Sound Investigations reporting that would later be known as the "Pornhub Tapes."
 
Rokita has also issued cease-and-desist letters to companies, webmasters and individual content creators, in some cases, AVN has noted.
 
The Free Speech Coalition, a trade group representing the adult entertainment industry, told AVN that this lawsuit is an error.
 
"Indiana’s suit suggests that no matter what adult companies do, no matter what precautions they take to comply, the state will find a way to punish them," said Mike Stabile, the coalition's director of public policy. "Under Indiana’s rationale, even platforms that have blocked the entire state of Indiana are liable because such blocks are not impenetrable. The same argument could be made about nearly every precaution taken to block minors. We warned legislators that this was an issue when these laws were drafted. We warned them that the internet was global and that platform-based verification elsewhere had proven severely flawed and ineffective. They passed the law anyway and are now trying to blame our industry for their bad policy."