X Still Asked My Age After I Changed Countries—Because It Was Checking My Account

The warning stayed on the post after I moved my VPN from London to Toronto. “Due to local laws,” X said, the sensitive media would remain hidden until it could estimate my age. I changed to New York, refreshed, and received the same message. Then I signed out, cleared the site data, connected through a third country, and logged back into the same account. The warning returned before the image had finished loading. I had changed almost everything except the one thing X was actually judging.

I was in a hotel near King’s Cross, using the laptop I carry for work.

A creator I followed had posted an update marked as sensitive. I was already signed in, I was over eighteen, and I had enabled the setting that allows sensitive media.

I expected the VPN to remove the regional prompt.

Instead, the prompt followed me across three countries in ten minutes.

That was when the problem stopped looking geographical.

The VPN changed my address, not my account

The UK’s age-check rules took effect for services allowing pornography on July 25, 2025, and X introduced age-assurance measures for restricted content. VPN downloads surged as the requirements came into force. (Ofcom)

The assumption behind many of those downloads was simple: if a restriction depends on location, changing the visible location should change the result.

That can work when a service is judging only the current IP address.

X was judging more than that.

Its age-assurance system can use signals already attached to an account, including previous verification, the date the account was created, and information connected to an email address or phone number. When those signals are not enough, X can request a live selfie or identity document. (X)

My account had been created in 2019.

It had never completed X’s verification process.

I had not added a birth date to the profile.

Changing the server altered the address used for the next request. It did not make the account older or add an accepted age result.

The prompt was following the unresolved account, not the hotel connection.

Once I understood that, the repeated country switching began to look like the wrong experiment.

More countries produced more friction

My regular VPN was a major provider with years of public history, a large support operation, and more locations than I would ever need.

For travel, those were reassuring strengths.

For this problem, the server map became a distraction.

I tried Canada because it was outside the UK.

Then the United States.

Then Switzerland.

Each server changed my public route. Each one returned me to the same restricted post after I signed in.

On one connection, X asked me to confirm a new login.

On another, it presented a CAPTCHA.

After the third location change, parts of my timeline stopped loading temporarily.

The VPN was doing its job: it was sending my traffic through another server and presenting that server’s address to X. It was not rewriting the account history stored by the platform. (Ftc)

The distinction became obvious only after I had spent several minutes staring at a country menu and a warning that began with “Due to local laws.”

Other adults have reported the same frustration: changing VPN locations does not remove the notice when the signed-in account still lacks an accepted age signal. (Reddit)

I had mistaken a persistent account decision for a location error.

Adding a birthday was not the same as verification

I opened the profile editor and added my date of birth.

Then I reopened the post.

The warning remained.

A self-declared birthday made the profile more complete, but X still had not completed its age-assurance decision.

The platform offered two routes forward: a live selfie for facial age estimation or an identity-document check.

I stopped before choosing.

My original plan had been to reveal less about the session, not to rush through a sensitive verification on hotel Wi-Fi while using a VPN account tied to my everyday email address.

The major provider had given me many places to appear from.

It had not reduced the number of identity links surrounding the check.

That changed what I needed from the VPN.

The useful question was no longer “Which country?”

I did not need another exit location.

I needed to complete the legitimate age check while adding as little new identity data as possible.

A VPN does not prove that someone is an adult. Its useful role begins around the check: protecting the connection and reducing the extra accounts attached to the process.

Once that became clear, the comparison narrowed quickly.

I wanted the laptop and phone protected together.

I did not want to create another conventional account before starting.

That was why I reopened a smaller app I had kept from an earlier test.

The smaller app did not add another email to the chain

OnlydogVPN had fewer locations, a shorter public history, and fewer independent reviews than my established provider.

Those were the reasons it had remained a backup.

This time, its smaller footprint was less important than one design choice: it allowed basic use without a conventional email-and-password account.

I could protect the session without attaching the VPN to the same inbox used for X, the hotel booking, and most of my travel accounts.

I opened the app and selected its private-browsing preset.

The connection came up without a registration form.

Then I returned to X.

The warning was still there, but now I understood why. The route was protected; the account still needed an age result.

I selected the live-selfie option.

X asked me to continue on my phone.

The smaller app let me add that phone with a short verification code rather than another username and password. A moment later, both devices were on the same protected setup.

I completed the selfie check on the phone.

The result appeared.

Then I returned to the laptop.

The post opened because the account had changed

The blurred media disappeared.

The creator’s post loaded in full.

I opened the profile’s media tab and selected a second sensitive post.

It opened without another prompt.

I refreshed the timeline.

The first post remained visible.

Nothing about the VPN country had changed during those steps.

What changed was the account. X had finally received an age result it could use.

Canada had not solved it.

New York had not solved it.

Switzerland had not solved it.

Completing the age check had.

The smaller app’s contribution was practical: it protected both devices through the process without creating another email-based identity around the session.

That was far more useful than another server switch.

The next screen gave me a reason to keep it installed

After the post opened, I returned to the smaller app to check the connection.

Its blocked-request counter had increased.

Advertising and tracking requests had been stopped while I moved through X and the verification flow.

That had not caused X to accept my age. The selfie result had already completed the main task.

But it reduced the unrelated traffic surrounding the check.

X needed enough information to update the account.

The verification service needed enough information to return the result.

Unrelated trackers did not need every background request generated along the way.

The counter made that smaller privacy gain visible after the restricted post had opened.

Why the prompt survived every server change

The reason was simpler than the warning made it sound.

The VPN changed the network path and the public address presented to X.

X’s age-assurance system was also using account-level information. That information remained when I changed countries, browsers, or hotel connections.

An unresolved age status did not become resolved because the login arrived from another IP address.

The location changed.

The account followed.

That is why the prompt survived every server change and disappeared only after the account received an accepted age result.

The wrong VPN comparison kept me stuck

I could not inspect X’s internal age-assurance rules or the exact processing behind its estimation system.

I could see which approach completed the task.

The major VPN offered broad coverage and let me try several countries quickly. Every attempt returned to the same unresolved account, while the repeated location changes added CAPTCHAs and login checks.

The smaller app did not pretend that another country would erase the prompt.

It protected the laptop and phone, avoided another conventional account, and carried me through the verification that X actually required. Once the age result reached the account, the sensitive posts opened and stayed open.

That was more useful than a map full of exits.

X had not been asking where I was.

It had been asking what it knew about the account.

The prompt followed my login, not my hotel IP; the useful VPN was the one that protected the proof instead of trying to replace it.