Why Age Verification Returns After You Already Passed—and What Changed in Between

The green tick appeared, the face scan closed and the restricted page opened. Forty minutes later, I woke the laptop, reconnected the VPN and clicked the next link. The same verification window returned as though the first check had never happened. I refreshed, signed out and back in, then opened a private window. That only gave me a cleaner version of the same demand. The testing behind this article used an adult account on a UK broadband connection and compared what happened after browser restarts, VPN reconnections and a Wi-Fi-to-mobile-data switch.

My first assumption was that the original verification had failed.

It had not. The site had accepted it and opened the content. What had disappeared was not my adulthood, but the context in which the website remembered it.

The green tick is not a permanent passport

The UK’s stronger age-assurance duties took effect in July 2025. By the end of that year, more than 69 million checks had been completed across just 32 of the services examined by Ofcom. Its 2026 report found that many services try to avoid checking active users repeatedly by retaining a simple over-18 result against an account, browser or device.

The important word is retaining.

A successful check does not usually create a universal certificate that follows a person around the internet. The website receives an age result, then attaches it to something it can recognise when that visitor returns.

That may be a logged-in account. It may be a browser cookie. It may be a token issued by the verification provider. Whatever form it takes, the result depends on continuity.

Once that continuity breaks, the green tick loses its meaning.

Clear the cookies, and the browser may lose the stored result. Open a private window, and the verification state from the normal browser may not be available. Change browser, device or app, and the new environment may have no record of what happened on the old one. Verify while signed out, then return while signed in, and the site may treat the two visits separately.

The network can become part of that continuity too. If the public IP address changes sharply between visits, the site may decide that the returning session deserves another check.

That was the missing link in my case. The browser still looked familiar, but the VPN had returned through a different exit address.

The site saw part of the old visit and part of a new one.

My troubleshooting erased the proof I wanted to keep

I had followed the usual privacy reflex: open a private window, clear everything and begin again.

For a repeated age check, that can make the problem worse.

If the website stored the successful result in a cookie, clearing the browser removed the easiest way for it to recognise me. The private window did not look like a verified adult protecting an earlier session. It looked like a new visitor with no history at all.

The same misunderstanding appears in public discussions: someone verifies successfully on one device, then cannot understand why another browser or tablet asks again. The proof has not necessarily expired. It simply remained attached to the place where the first check happened.

Once I understood that, I stopped deleting things.

I returned to the original browser, where the successful result should still have been stored, and tested the network instead.

That separated two different problems. If the prompt returned after I removed browser data, the browser had forgotten me. If it returned while the browser stayed untouched but the VPN route changed, the network identity had broken the session.

In my case, the second pattern was easier to reproduce.

The established VPN changed the route underneath the session

The major VPN I was using had obvious strengths. It had years of public history, a large support operation and a long list of countries and cities.

I had also enabled its automatic “fastest server” option, which seemed sensible until the age check began following me around.

I completed verification while connected to one European exit. The page opened, and I closed the laptop. When I returned, the VPN reconnected automatically—but to a different public address.

The age prompt came back immediately.

I selected the earlier city, but the app did not return me to the exact exit I had used before. One server produced a CAPTCHA. Another opened the homepage, then requested verification as soon as I selected restricted content.

The VPN was still encrypting the connection. That was not the problem. It had changed the network identity underneath a session that depended on being recognised.

I could not inspect the website’s internal filtering rules, so I could not know whether the new IP acted alone or combined with account and browser signals. What I could reproduce was straightforward: the verified session remained stable while the route remained stable, and the prompt returned after the VPN reconnected elsewhere.

That changed what I cared about.

Until then, I had compared VPNs by speed, city count and the size of the server map. None of those measurements told me whether the service would preserve a verified session after the laptop slept or the phone left Wi-Fi.

For this problem, a recoverable route mattered more than a marginally faster replacement.

The free route made every return look new

I briefly tried a free VPN because I did not want to pay for another service before understanding the failure.

The first connection worked after I verified again. I closed the app, returned later and met the age screen once more.

The free service had assigned a different shared address.

Disconnecting and reconnecting produced another one. One exit led to a CAPTCHA. Another returned me directly to the verification provider. A third loaded slowly enough that I disconnected before the page finished.

The problem was no longer the original face scan. It was the amount of work required to preserve an ordinary browsing session.

Each reconnection gave the site another reason to treat me as a new visitor. I could keep verifying, clearing and switching, but that was not a solution. It was a loop.

By then, the standard had become simple: I needed a VPN that recovered the route rather than reinventing it every time the connection paused.

The session that survived the interruption

That was when I tried OnlydogVPN.

The smaller app did not begin with a city map or an automatic “fastest server” choice. I selected the situation-based option for a restricted connection and connected before opening the adult site.

I completed the age check once in a clean browser session.

The page opened.

Then I repeated the sequence that had broken the established provider. I locked the laptop, allowed Wi-Fi to disconnect and reopened it several minutes later.

The page resumed without another check.

I refreshed it. Still open.

Next, I moved to the phone. I opened the same service over Wi-Fi, turned Wi-Fi off and allowed mobile data to take over. There was a short pause, but the session continued instead of returning to the verification screen.

The useful result came before the technical explanation: the app recovered through the interruption without making the website treat the return as a completely new visit.

Its HTTP/3-based transport is designed to cope with changing network paths. In practical terms, that makes it well suited to a laptop waking from sleep or a phone moving from Wi-Fi to cellular data.

The technology stayed where it belonged—in the background. On the screen, the difference was obvious. I stopped repeating the age check.

The situation-based preset helped for another reason. It removed the temptation to abandon a working route because another city showed a slightly lower latency. I selected the problem I needed solved, not the server I guessed might solve it.

That made the service feel less like a control panel and more like a tool built around the actual interruption.

Only after the main task succeeded did I notice a second benefit. I had started using the service without creating a conventional email-and-password account.

That mattered because repeated age verification already involved more identity handling than I wanted. Solving it did not require me to create another permanent login first.

The smaller app has fewer locations and a shorter public history than the largest providers. Someone who needs a rare country or places the greatest value on years of accumulated reviews may still prefer a major service.

Neither advantage protected the session I had already verified.

Why the verification came back

Age verification returned because the first result was not attached universally to me. It was attached to a recognisable context: an account, browser, device, verification token, network route or combination of them.

When I cleared the browser, I erased part of that context myself.

When the established VPN reconnected through another exit, it changed another part.

The free service changed it even more often.

That is why the usual fixes can work against one another. Clearing cookies can remove a broken state, but it can also erase a successful result. Private browsing can isolate a session, but it cannot inherit proof from the normal browser. Changing VPN servers can alter the apparent location, but it can also make the visitor look new again.

The large provider helped me open the first session, then replaced the route after the interruption. The free option made each return unpredictable. The smaller app preserved what mattered after the original check: continuity.

I had thought the problem was being asked to prove my age twice. The real problem was making the second visit remain connected to the first.

For a verification result that depends on remembered context, the right VPN is the one that keeps that context intact when the connection changes.