Why Age Verification Fails in Incognito Mode—and What Finally Made It Work

The selfie check appeared after I opened an age-restricted discussion thread in an Incognito window. I centered my face, turned toward the light and waited. The verification provider confirmed that I was over 18 and sent me back to the original page. Instead of opening the thread, the site displayed the same button: Verify your age. I blamed the camera, repeated the scan and got the same result. On the third attempt, the verification page stopped loading altogether.

The verification worked. The handoff did not.

I had opened Incognito mode deliberately.

I was using hotel Wi-Fi, and the subject of the discussion was personal. A private window felt like the natural place to read it without leaving history, cookies or account details behind.

The age check itself appeared to succeed. The camera opened. The face scan completed. The provider showed a confirmation message.

Yet every return to the original site erased that success.

Since July 25, 2025, UK services carrying pornography and other regulated material have had to use highly effective age assurance. Accepted methods include facial age estimation, photo-ID checks, credit-card checks, mobile-network information and digital identity services.

The rollout also changed how people approached privacy. UK interest in VPNs rose sharply around the deadline, while public discussions repeatedly returned to the same concern: reaching the page was only part of the problem; users also wanted to know who received their data during verification.

That described my hesitation. I was willing to prove I was an adult. I was less comfortable linking a sensitive page, a hotel network and another identity service more closely than necessary.

Incognito seemed like the answer.

It was also interrupting the answer on its way back to the site.

Incognito kept starting the process from zero

Chrome keeps temporary cookies and site data while an Incognito window remains open, then deletes them when the session ends. It also blocks third-party cookies by default in Incognito mode.

That matters when the website and the age-verification provider are separate services.

The site sends the browser to the provider. The provider checks the selfie, ID or other evidence, then returns a result saying the visitor passed. The original page must receive that result and remember it.

If the browser restricts the cookie or temporary storage carrying the result between the two services, the scan can succeed while the page behaves as though nothing happened.

That produced the loop on my screen:

Open the thread.

Complete the check.

Return to the thread.

Verify again.

Other users describe the same practical frustration more simply: the check says it succeeded, but the page immediately asks for it again.

That was enough to confirm I was not dealing with a bad camera angle. The verification result was being lost between the provider and the page.

Once I understood that, repeating the selfie became pointless.

I had chosen privacy at the wrong layer

The word “Incognito” had encouraged me to treat the private window as a complete privacy shield.

It is not.

Incognito is useful when I do not want the browser to retain local history, form entries and session data after the window closes. It helps prevent the next person using the device from reopening the trail.

It does not hide the destination from the hotel network or internet provider. The network still carries the connection, and the website still receives a public IP address.

That was the privacy boundary I actually cared about.

I was using my own laptop. Nobody else was likely to inspect its browser history. The unfamiliar hotel network underneath it was the part I did not trust.

Incognito protected the device after browsing, but weakened the temporary browser state needed during verification.

I had sacrificed the function I needed for protection in the wrong place.

The obvious fix was to use a regular window. But doing that without changing anything else felt like abandoning the privacy concern that had put me in Incognito mode.

So I separated the two problems.

The browser needed enough temporary memory to complete the age check.

The network connection needed privacy of its own.

The familiar VPN added another identity step

I first opened a large VPN provider I had used before.

It had a long public history, extensive documentation and a broad server network. Those were sensible reasons to trust it on hotel Wi-Fi.

The app asked me to sign in.

My password manager was locked behind another device check, and the hotel connection was already making each page feel slower than it should. I retrieved the VPN account password, completed the login and connected.

Then I returned to the site in a regular browser window.

The verification page loaded, but the shared VPN address triggered a CAPTCHA before the face scan. I solved it, completed the age check and returned to the thread.

The site asked me to verify again.

I changed servers and repeated the process. This time the verification completed, but the redirect returned an error page. Another server produced another CAPTCHA.

The established provider had improved the privacy of the hotel connection, but it had added a second account system and a series of crowded exits to a process already overloaded with identity checks.

The problem was no longer a lack of servers.

I needed fewer steps between opening the browser and completing the handoff.

The regular window worked once the route did

I opened OnlydogVPN and selected the private-browsing situation.

There was no conventional email-and-password registration before the first connection. I did not have to retrieve another credential or attach the session to a new account before learning whether the route worked.

I connected, then opened the original site in a regular browser window.

The verification page loaded normally.

I completed the same face scan, received the same over-18 result and returned to the original tab.

The button disappeared.

The discussion thread opened beneath it.

I refreshed the page. It stayed open. I followed a link to another restricted section, then returned. The verification state remained available instead of disappearing during the handoff.

That was the result I had been trying to produce all evening.

The Incognito window had repeatedly completed the scan without completing access. The regular browser session carried the result back and remembered it, while the VPN protected the network path underneath.

The division of labour was finally correct.

The browser stored the temporary state the site needed.

The VPN kept the hotel network from seeing the individual pages inside the encrypted connection.

And the smaller app did not require another conventional identity step before I could test it.

Fewer visible privacy gestures, one completed task

Before this, I had equated more privacy indicators with more privacy.

Incognito icon.

Blocked third-party cookies.

No saved session.

No history after closing.

Each choice sounded protective. Together, they prevented the site from remembering the one result required to open the page.

The smaller app took a quieter role. It did not ask me to browse a long map or adjust protocols. It handled the network layer while leaving the browser free to complete the verification flow.

That mattered more than a larger feature list.

OnlydogVPN has fewer server locations, a shorter public history and fewer independent reviews than the largest providers. But this problem did not require the largest map. It required a private route, no extra account ceremony and a browser session capable of remembering success.

The established option gave me more infrastructure to choose from.

The smaller service gave me fewer opportunities for the verification flow to break.

The secondary benefit appeared after the page opened

Once the thread was available, I noticed the app’s blocked-request counter increasing.

The service was filtering advertising and tracking requests generated by the pages I visited. I could see the counter change, although I could not independently inspect every internal filtering rule.

That filtering did not fix the verification loop. The regular browser session had already preserved the result.

It solved the next, smaller concern.

Allowing the site to retain the cookie or session state required for age verification did not mean every advertising and analytics request on the page also needed to complete. The filtering reduced some of that background activity without sending me back into the browser mode that had broken the handoff.

That distinction felt useful:

The site could remember that the age check had succeeded.

Unrelated tracking requests could still be reduced.

Privacy did not have to mean preventing the page from functioning.

Closing the window explained the repeated checks

After reading the thread, I closed the browser and opened a new Incognito window.

The site asked me to verify again.

This time, the result made sense. The private session had been discarded exactly as the browser was designed to discard it.

That behaviour is useful on a shared computer. It also means that a verification result stored only in the private session disappears with the window. The next Incognito session looks like a new visitor and starts the process again.

This is why repeatedly clearing cookies, closing private windows and restarting the browser can make the problem worse. Each attempt removes more of the information the site uses to remember that the visitor has already passed.

I had spent twenty minutes trying to make the verification more private by erasing its memory.

What I needed was not a browser that forgot everything immediately. I needed the browser to remember one temporary result while the network revealed less about where I went.

The private window was not the privacy tool I needed

Incognito had done what it promised. It separated the session from normal browsing data and removed it afterward.

It had not hidden the destination from the hotel network, and it had not helped the verification result survive the trip back to the site.

The working setup was less dramatic.

I used a regular browser session long enough for the age result to persist. I placed the connection inside a VPN that did not require another conventional account. Once access worked, filtering reduced some of the extra requests around the page.

The Incognito window showed more visible signs of privacy, but it kept sending me back to the start.

For that age check, the useful privacy setup was not making the browser forget everything. It was letting the page remember the one result it needed while revealing less to the network underneath it.