But both parties also agree that there is no way for a website operator to determine a user’s physical location with perfect certainty. Aylo argues that Utah’s actual location requirement means that Aylo must “impose age verification on every user of their platforms, everywhere in the world” because it is impossible to know for sure whether any given user actually is in Utah.

It becomes a purely jurisdictional issue, as Server Location A sending data to Router Location A wouldn't be subject to jurisdictional in Location B.

At best, the Router would be liable for transmitting the data across state lines. But really, you'd think the Client would be the one breaking the law, by importing illicit data.

Of course, this would mean any attempt to prosecute the law would just bring the hammer down on Client side. A bit like saying you can only prosecute a cop in a drug sting for illegal possession.

Looking everywhere except the mirror

https://floodlit.org/

Good ruling, but weird reasoning.

I would have thought the reasoning should be that in a legal system based on the rule of law, people need to be notified and able to inform themselves of which laws exist and apply to them. The source in the text of the US Constitution for this idea could be in the part about depriving people of liberty without due process of law.

If a company has no way of knowing or exercising control over whether users are accessing its services from Utah, how can Utah apply any of its state laws to that company?