How do you securely police the "20 free articles a week" system if you can't trust cookies, can't put validation on the page itself, and ip addresses change all

How do you securely police the "20 free articles a week" system if you can't trust cookies, can't put validation on the page itself, and ip addresses change all the time without requiring even a free account to read the content? You assume that the number of people with the ability and desire to circumvent your defenses is a small fraction of your total audience, and ignore them.