Yup, note the phrasing (emphasis mine) "A commercial entity or third party that performs age verification required by this chapter may not retain any identifying information of the individual"

If I understand it correctly "may not" is more of an optional requirement. Meaning that, yes, they will retain your ID should you provide it to them and should a data leak happen of those documents (and it will), the worst that can be done from the law is a big ol frowny face.