adaliabooks: As zeogold already mentioned, Destro covered this in another thread:
https://www.gog.com/forum/general/gog_will_enable_twostep_login_on_all_existing_accounts_on_oct_24_2016/post165/?staff=yes They're using multiple factors to check if 2 step is needed, so it's working as intended.
Though ironically, the people who delete cookies because they don't want to be tracked are presumably wasting their time as they are being tracked without them anyway... therefore they might as well just keep the cookies anyway XD
Well then it must have changed just this week then, assuming those "factors" include IP because as I said, I don't really see any other way they could check on a fresh clean install of Windows 10.... cause I'm like 100% positive it asked me every single time I cleared my browser which was about a week or two ago.
Not to mention, I know for a fact a file is created in Galaxy with this information (or it was) and on a fresh install it still didn't ask for a code.
EDIT: Thanks for a direct link though, have updated the OP.