I Was Already Proving My Age—My VPN Did Not Need My Identity Too

The age-check page wanted a selfie before it would let me download my account archive. The link expired in thirty-seven minutes, I was working from a shared lounge in a Birmingham apartment building, and the archive contained billing records I needed before deleting an old adult-site account. I blamed the public Wi-Fi when the verification page stalled, refreshed it, and lost the first session. On the second attempt, the camera opened—but so did the question I had been avoiding: if I was already giving an age-verification company my face, how many other companies needed identifying information from me along the way?

The adult account was nearly eight years old.

It still carried an old email address, expired payment details, saved searches, and a viewing history I no longer wanted attached to anything.

I had requested a data export before closing it. The platform emailed a temporary link, then placed its age gate in front of both the download and deletion controls.

I was willing to complete the legitimate check.

I was not willing to create several new identity records while proving one fact.

The age check was necessary; the extra accounts were not

By 2026, age checks had become routine for UK users. Ofcom reported tens of millions of checks across a sample of online services after stronger age-assurance requirements took effect. Many of the country’s most visited adult services had introduced checks, while others had restricted UK access.

That explained why the prompt appeared.

It did not mean every company involved needed to know who I was.

An age verifier might examine a selfie, identity document, mobile-network status, banking signal, or another credential. The adult site may need only the result:

Age requirement met

That is the cleaner exchange. The verifier handles the evidence, while the site receives the minimum answer required to open the account controls.

UK data-protection guidance follows the same principle. Age-assurance services should explain what they collect, why they retain it, whether another company receives it, and how long it remains stored. They should not collect more than the check requires or reuse it for unrelated profiling.

That gave me a standard for the verification page.

It also gave me a better standard for the VPN.

I did not need another company asking for my email address, password, payment history, and security approvals before it would protect the connection.

I needed the VPN to stay out of the identity chain.

My established provider protected the Wi-Fi but added another profile

I opened the established VPN I normally used while traveling.

It had a large server network, mature applications, and years of public history. Those were sensible reasons to trust it on shared Wi-Fi.

The app had signed itself out after an update.

I entered my VPN email address and password.

A security message arrived on my phone.

I approved it, selected a nearby server, and reopened the temporary archive link.

The adult platform asked me to sign in again.

Then the age verifier opened in a new tab.

A CAPTCHA appeared before the camera check.

I completed it and positioned my face inside the frame.

The lounge Wi-Fi weakened.

The VPN reconnected through another server.

The verifier displayed:

Session expired

Twenty-nine minutes remained.

I restarted the process, but my comparison had already changed.

The provider was hiding the destination from the building’s shared network. At the same time, it had inserted another identity-linked account into a task that already involved an adult profile and a facial age check.

Its large network did not reduce that exposure.

It simply gave me more servers from which to repeat the same identity-heavy process.

The concern appears often in public VPN discussions: a privacy tool feels less private when using it begins with another account tied to the person behind the connection.

That was enough to sharpen the decision.

I had started with the most familiar provider.

Now I wanted the one that asked for less.

Another server repeated the same problem

I chose a low-load server and began again.

Account login.

Archive link.

Age gate.

CAPTCHA.

Camera.

The verifier accepted the scan and displayed:

Confirming your result

Then the building network paused as someone nearby joined a video call.

The page stopped.

When it recovered, the adult platform had returned to the sign-in screen.

Twenty-two minutes remained.

I could keep changing servers, but every attempt rebuilt the same chain: VPN account, adult account, age verifier, browser session, and shared network.

The server choice was not the weak point.

The number of identity links was.

I briefly considered using only a private browser window. That would keep the visit out of my normal local history after the window closed, but it would not protect the destination from the building network or stop advertising and analytics requests while the page was open.

Private mode cleaned up afterward.

I needed protection during the transaction.

More specifically, I needed a stable connection that did not begin by asking me to identify myself to yet another service.

The smaller app connected before asking who I was

I closed the established provider and opened OnlydogVPN, which I had installed as a backup.

The smaller app did not require a conventional account or an email-and-password login before connecting.

Instead of opening on a server map, it asked what I was trying to do.

I selected the preset for age verification on shared Wi-Fi.

The connection opened.

That removed one account from the process immediately.

I returned to the temporary archive link and opened it in a fresh browser profile. The adult platform still required its own login because it needed to know which archive belonged to me.

The VPN did not add another one beside it.

I opened the age check.

The verifier’s privacy summary said the platform would receive the age result rather than the face image.

I completed the scan.

The lounge Wi-Fi slowed again.

The page remained on:

Confirming your result

A few seconds later, the message changed:

Age requirement met

The archive page opened.

That was the first complete result of the afternoon.

The legitimate age check had finished.

The adult account had received the answer it needed.

The shared network had not seen the destination directly.

The VPN had protected the session without creating another email-linked identity profile around it.

The archive survived the next interruption

The archive contained four sections:

Account information.

Billing history.

Saved activity.

Privacy settings.

I pressed Download all.

The progress bar reached 34 percent before the lounge network weakened again.

The download paused.

It did not fail.

A moment later, it continued from the same point.

61 percent.

83 percent.

100 percent.

The smaller app’s HTTP/3-based route recovered without discarding the session. That was the technical difference, but the useful difference was simpler: I did not have to repeat the login, CAPTCHA, or selfie.

I opened the archive and checked that the billing records were present.

Then I returned to the adult platform and selected Delete account.

The site asked for the account password again.

I entered it.

A final warning appeared:

Deletion cannot be reversed

I pressed Delete permanently.

The dashboard disappeared.

A confirmation email arrived:

Your account has been scheduled for deletion

Eleven minutes remained on the original archive link.

The task was finished.

I had completed the required age check, downloaded the records, and closed the account without building another identifying VPN account around the process.

That mattered more than having another hundred servers to choose from.

The counter revealed the traffic I had never requested

After the deletion confirmation arrived, I noticed a number beside the smaller app’s shield icon.

Its blocked-request counter had increased while I moved through the adult platform, age verifier, archive page, and deletion form.

Several advertising and tracking requests had been stopped.

The official parts of the task still worked.

The age result reached the platform.

The archive downloaded.

The deletion request completed.

The blocked requests belonged to services that did not need to participate.

That made the counter more than a privacy decoration. It showed that the app was reducing the surrounding data trail while preserving the actions I had chosen.

The adult platform needed to recognize my account.

The verifier needed to confirm my age.

The archive server needed to deliver the files.

Advertising systems did not need to know that those events happened together.

The VPN had first removed its own unnecessary identity account from the chain.

Then it reduced the unnecessary traffic leaving the page.

Age-verification privacy begins with asking who does not need your identity

I could not observe every internal logging rule used by the adult platform, its verifier, the building network, or either VPN provider.

I could compare what each setup required from me and what completed the task.

The established provider protected the shared Wi-Fi, but it required another conventional account and repeatedly sent me through login and security steps while the age-check session expired.

The smaller app connected without identifying registration, kept the official verification alive through the weak network, and blocked unrelated tracking around the transaction.

It has fewer server locations and a shorter public history than the established provider.

Those are real limitations.

They did not decide which service was better suited to this age-verification task.

The important questions were narrower:

Does the VPN require another identity-linked account before it will protect the session?

Can it keep the verification alive when the network weakens?

Does it reduce unrelated tracking around the verifier and destination site?

Can the user see that reduction happening?

The smaller app answered those questions on the screen rather than in a slogan.

The age check completed.

The archive downloaded.

The account was deleted.

I was already proving the one fact the platform legitimately required.

The better VPN was the one that did not ask me to build another identity record around that proof.