A federal judge in Utah has temporarily halted one of the most aggressive attempts yet by a state to neutralize VPN use, while the Second Circuit has moved in the opposite direction on digital privacy, ruling that border agents may manually search a traveler's phone without any suspicion of wrongdoing. Together, the two rulings capture a widening split in how American courts are treating the tools people use to protect their location, their data, and their movements online. This month's edition of Decrypting a Defense, the newsletter produced by The Legal Aid Society's Digital Forensics Unit, walks through both decisions and closes with a conversation with law professor Andrew Guthrie Ferguson.
Utah's "Actual-Location" Provision Runs Into the Constitution
On September 24, 2026, the U.S. District Court for the District of Utah issued a preliminary injunction blocking a provision of state law that would have required adult websites to verify the age of any user physically located in Utah, regardless of what a VPN reported about that user's location. VPNs work by routing a person's internet traffic through an encrypted tunnel, often to a server in another region or country, which is why so many privacy-conscious users rely on them to mask location data, resist tracking, or simply connect to a nearby server for better speed without exposing their real whereabouts to every site they visit. Utah's amended statute tried to pierce that shield by declaring that disguising one's location through a VPN or proxy server was irrelevant - if a person was actually in Utah, the law applied, full stop.
Aylo, the parent company of several major adult sites, argued that no technology can determine a user's physical location with certainty, and that the law would effectively force it to impose age verification on every visitor worldwide, just to catch the Utah residents hiding behind a VPN. The court agreed that this created an undue burden on interstate and international commerce, a violation of the Dormant Commerce Clause, and found Aylo likely to succeed on the merits. The injunction only pauses the "actual-location" language; the underlying age-verification requirement remains in effect, and Utah retains the option to rewrite the provision or appeal.
The Second Circuit Narrows Fourth Amendment Protection at the Border
In U.S. v. Alisigwe, the Second Circuit held that a manual, officer-conducted scroll through a traveler's phone at the border counts as a "routine" search, meaning Customs and Border Protection does not need reasonable suspicion to perform it. The court left open whether a forensic search - one that copies data using specialized software - would be treated differently. Its reasoning leaned on a long-standing doctrine that the government's interest in screening people and goods entering the country rises as the traveler's privacy interest falls, a framework first articulated in cases involving luggage and vehicles rather than devices holding years of personal messages, photos, and location history.
The ruling directly rejected earlier decisions out of the Southern and Eastern Districts of New York, which had found that phone searches are nonroutine and require a warrant given how much personal data a device can hold. The Second Circuit called that reasoning "wrong," arguing that the sheer volume of personal information on a phone strengthens, rather than weakens, the government's interest in inspecting it. For travelers, the practical consequence is stark: U.S. citizens can refuse to unlock a device, but agents may seize it anyway, while non-citizens who refuse risk detention.
Five Questions With Andrew Guthrie Ferguson
This month's guest, Andrew Guthrie Ferguson, a professor at George Washington University Law School and author of works examining data-driven policing, traced his interest in surveillance technology back to his years as a public defender. A single suppression hearing, where an officer justified a stop by invoking a "high-crime area" with no supporting data, set him on a path of subpoenaing crime statistics and challenging unsupported claims in court. That early curiosity about how data shapes police power has since expanded into broader research on facial recognition, predictive policing, and the growing array of tools reshaping the balance between citizens and the state.