The Browser VPN Icon Was Green—But the Age Check and Download Still Used Hotel Wi-Fi

The VPN extension said Protected when the age-verification page moved from my laptop to my phone. I had installed it because I was using hotel Wi-Fi, and the green icon in Chrome made the decision feel complete. Then I scanned the verification QR code, watched the page open on my phone, and noticed there was no VPN symbol there at all. The adult site was protected inside one browser window; the identity check connected to it was travelling directly through the hotel network. I switched the phone to mobile data, restarted the check, and lost the session on the laptop.

I was staying near Manchester Airport before an early flight.

The site held a video I had already paid for, and I wanted to save it for offline viewing before leaving the hotel. The download itself should have taken ten minutes.

The privacy setup consumed the first twenty.

My mistake was understandable: the site was open in Chrome, so protecting Chrome felt like protecting the entire task.

The QR code showed me that it did not.

The extension protected the first page

Since July 25, 2025, UK services that allow pornography have been required to use highly effective age checks. By 2026, those checks had become a normal part of accessing adult sites, often involving a separate verification provider, a QR handoff, or another step outside the original page. (Ofcom)

The extension seemed made for this kind of quick, private session.

It installed in less than a minute.

I selected a nearby route, refreshed the site, and confirmed that Chrome showed the extension’s exit address instead of the hotel connection.

The site loaded.

My account opened.

Then the age-check page displayed a QR code and asked me to continue on my phone.

That was the first moment the green icon stopped answering the question I actually cared about.

The extension was still protecting Chrome.

The verification had already left Chrome.

The phone reopened the route I thought I had closed

My phone was connected to the same hotel Wi-Fi as the laptop.

When I scanned the code, its browser contacted the verification provider directly. The extension installed in desktop Chrome had no control over the phone.

I switched the phone to mobile data and began again.

The verification succeeded, but the handoff back to the laptop expired. Chrome was still showing the original QR code as though nothing had happened.

On the next attempt, I left the phone on hotel Wi-Fi.

The check completed and returned me to the adult site. But I had now sent the most sensitive part of the process—the age check—through the public network I thought I had protected.

The extension had not failed.

It had simply reached the edge of its coverage.

A browser VPN extension changes how supported traffic from that browser leaves the device. It does not automatically protect another phone, another application, or everything else running on the laptop. (Chrome)

The adult site was inside the protected boundary.

The phone was outside it.

The download exposed the next gap.

The file left Chrome before it reached the laptop

After verification, I returned to my purchased library and pressed Download.

Chrome retrieved a small launcher file. Windows then opened the site’s desktop media application, which handled the larger video transfer.

The extension icon stayed green.

The desktop downloader was not using it.

I noticed because the transfer speed changed sharply when the separate application opened. An IP check inside Chrome showed the VPN location. A request made outside the browser showed the hotel connection.

The two programs were leaving the same laptop by different routes.

That can be useful when someone deliberately wants to protect only one browser. It is a problem when a browser-based task quietly hands its largest transfer to another application.

Other users have run into the same surprise: the extension protects the selected browser, not email clients, download tools, or unrelated desktop apps. (Reddit)

That was exactly what happened here.

The extension protected the page where I clicked Download.

It did not protect the program receiving the file.

The green icon hid the important distinction

Browser extensions and full VPN applications often use the same reassuring words:

Connected.

Private.

Protected.

But they cover different things.

The extension routed Chrome.

A full VPN application could route the laptop’s browsers, desktop programs, and background connections together. (Microsoft)

That difference mattered because my “browser session” was no longer just a browser session. It now included:

• Chrome;
• a third-party age-verification service;
• a phone browser;
• a desktop media application;
• and the transitions between them.

Protecting only Chrome meant I had to notice every time the task escaped it.

The extension gave me a private tab.

I needed a private process.

Its browser permissions added another uncomfortable trade-off

Before trying again, I opened the extension’s details.

It requested permission to read and change data on the websites I visited.

Some extensions need broad access to perform their functions. But those permissions can also give an extension visibility into page content, tabs, and browsing activity. (Google)

On an ordinary shopping page, I might have accepted that trade-off without much thought.

On an adult site connected to an age-verification flow, it felt more significant.

I had chosen the extension because it seemed lighter than installing a desktop application.

In practice, it protected less of the task while asking for deep access inside the browser where the sensitive activity occurred.

That was the opposite of the balance I wanted.

Running two VPNs would make the session harder to follow

The obvious workaround was to keep the extension active and install a second VPN for everything outside Chrome.

That would cover the desktop downloader.

It would not solve the phone unless I installed something there too. I would also have multiple routing systems making separate decisions.

Chrome might use one location.

The desktop application might use another.

The phone could complete the age check through a third.

More layers would not make the session feel more private. They would make it harder to know which route each step was using.

I disabled the extension.

By then, the requirement was simple: one protected route for the entire laptop, plus a quick way to bring the phone into the same setup.

The smaller app protected the task, not just the tab

OnlydogVPN was already installed from an earlier test.

It had fewer server locations, a shorter public history, and fewer independent reviews than the established services I usually considered first. Those were the reasons it had remained a backup.

But this was not a server-count problem.

I opened the app and selected its private-browsing preset.

The service connected at the device level. Chrome, the desktop downloader, and the laptop’s other traffic now shared the protected route.

I reopened the adult site.

The age-check page appeared again.

When it displayed the phone QR code, the smaller app let me add the phone with a short verification code. I did not need to create another account or type another password.

I entered the code on the phone.

The VPN symbol appeared beside its Wi-Fi indicator.

Now the laptop browser, the desktop application, and the phone used for verification were all protected.

I scanned the QR code again.

This time the verification returned to the right session

The age-check page opened on the phone.

I completed the required step.

The phone displayed a success message, and Chrome moved directly into my library instead of leaving me with an expired QR code.

I selected the purchased item and pressed Download.

The desktop media application opened.

The transfer continued.

I checked the route once more because the extension’s green icon had taught me not to rely on a status label alone. Both Chrome and the desktop application were now using the protected connection rather than the hotel address.

Ten percent.

Thirty-one.

Fifty-four.

The hotel Wi-Fi weakened when the heavy corridor door closed between my room and the nearest access point.

The download paused.

Then it resumed from the same position.

I did not have to repeat the age check, reconnect an extension, or wonder whether the desktop application had fallen back to the hotel network.

The task had crossed two devices and three applications, yet it finally behaved like one session.

The completed file settled the comparison

The download reached 100 percent with seventeen minutes left before I needed to leave for the terminal.

I disconnected the laptop from Wi-Fi and opened the file offline.

It played.

Only then did I return to the VPN app.

The meaningful result was not that a connection screen said Protected. Both approaches had shown me a reassuring status.

The difference was what remained protected after the first page:

The adult site loaded in Chrome.

The age check completed on the phone.

The result returned to the correct browser session.

The desktop application downloaded the purchased file.

The extension handled the first step.

The full app carried the entire sequence.

A browser extension works best when the task stays in the browser

The extension was fast to install and easy to isolate. Someone who deliberately wants one browser routed differently from the rest of the device may prefer exactly that behavior.

My mistake was assuming that adult-site activity stayed inside one tab.

Modern access flows cross boundaries. Age verification can move to another provider or another device. A download can open a native application. Payment approval can move to a banking app.

Once the task leaves the browser, the extension’s simplicity becomes its limit.

I could not observe every internal routing decision made by the services involved. I could see the outcome: the extension protected Chrome while the phone and downloader used other routes; the full application covered the laptop and brought the verification phone into the same protected setup.

That was the comparison I should have made from the beginning.

One protected window was not one private session

I began the evening comparing installation time.

The extension won before I had unpacked my bag. It took less than a minute and placed a green shield beside the address bar.

But the private activity was not contained beside the address bar.

It extended to the age check, the second device, the desktop downloader, and every handoff between them.

The smaller app required a full installation, but afterward it demanded less attention. I did not need to remember which program was protected, which device had escaped, or where the file transfer had gone.

For adult-site privacy, the decisive difference was not extension versus application as a matter of format.

It was protecting one browser window versus protecting the complete session.

The extension covered the click.

The full app covered what happened after it.