This conflates verification at a point in time vs persistent identity storage everywhere in the chain—not the same thing.And how does one establish this "age token"? How are you able to attach this to a person without someone, at some point, knowing their identity? Same with third party verification, the only way THEY cna verify is if they somehow know who you are too.
All these systems rely on your private information at the end of the chain.
Of course at some point, someone may need to verify age against an authoritative source. That’s unavoidable; but it’s also not the problem. The question isn’t whether identity is ever used. The questions are: who sees it, how long do they keep it, and is it linkable afterward.
Modern privacy-preserving systems are specifically designed to separate those steps. Here’s a quick list to consider. Feel free to do the research:
* Zero-Knowledge Proof (ZKP) age verification
* Blind signature age tokens
* W3C Verifiable Credentials (selective disclosure age proof)
* Idemix attribute-based credentials
* Microsoft U-Prove credentials
* Decentralized Identity (DID) age claims
* Mobile Driver’s License (mDL) age-only verification
* BankID age confirmation (attribute-only)
* Mobile Network Operator (carrier) age verification
* Privacy-preserving biometric age estimation (on-device)
It’s not that privacy-preserving age verification is impossible, it’s that it’s not the cheapest, fastest, easiest to explain legally, or what regulators explicitly reward. And users rarely actually punish companies for over-collection.
In other words: lazy and self-serving. Companies take the path of least resistance because they feel it’s institutionally safer.