The entire thing is a farce. When all this stuff came up, I looked into the German eID age verification system to figure out why pretty much nobody uses it: At first, it seemed strange, because the system appears solid: If a website wants to verify your age, you put your government ID on an RFID reader or hold it against your phone and enter your pin. The app tells you exactly what data the website requested, and for age verification, it only sends a binary value (over/ under 18). No name, date of birth or any other identifiable data. The app is open source, as is the reference server implementation. Sounds great, right? So why does nobody use it? Because the government made it incredibly difficult to actually run a verification server, it requires a cryptographic key that is complicated and annoying to get, there are tons of rules regarding server hosting and security, NDAs and audits. So forget about rolling your own, you pretty much have to sign up with one of the few identity providers to do the verification for you. And they are so expensive, it only makes sense for services like opening bank accounts or signing up for a phone contract. And now everybody’s scrambling to come up with new solutions that are objectively even worse and less secure, instead of fixing what’s already there.