Personally I have two problems with this : 1. Can't those tokens be used for cross-site tracking ? But more importantly : 2. I don't care if the implementation is technically perfect. I refuse to verify my age on principle.