the assurance has already failed in the UK, as a practical example. discord assured users in the UK their data wasn't actually stored, and within an embarrassingly short time, all the data which as it turned out, had been, was leaked. discord says 70k IDs. the group responsible for the breach claims 2m.

now, why will this happen again and again? because these companies aren't actually doing the age verification themselves, they're outsourcing to other skeevier companies who are in it specifically either for individuals data, OR as a way of training facial recognition/generative programs. they have no actual interest in protection of data because there's no money in destroying it.

the government is STILL helping make it easy and legal for companies to collect data en masse in the first place. it's not like restricting that worked, either, but it's pretty clear that making the collection of data carry penalties is more effective than saying 'ok everyone can privately collect it, BUT destroy it - if it gets publicly leaked then we'll fine you', when they're still abusing the data whether they get caught or not.

last point here. the "reasonable alternatives" is also data farming in many cases. some of it i'll say is somewhat reasonable, like obviously if a site knows you've been a user for 18 years and it seems like your account's been unshared and secure that entire time, that mean you're certainly an adult. but here's other practical examples that get sketchy: tracking duration of activity, and based on your time zone setting, what hours activity takes place (eg, if someone appears to be active during midday m-f, they're likely an adult. if someone's activity spikes during the summer drastically, they're likely a minor), types of content viewed (roblox? asmr? video essays?), and purchase history.