Any age verification should come with an OAUTH style government run API. The idea being you verify your ID with the government, and the service that required age verification gets back a true or false for does this user meet this age requirement. That way the amount of data shared is kept to a minimum. The UK, and Brazil who passed a similar law, 'cheated' by just forcing private companies to figure it out.
It will be fun when (not if) the database is leaked.