The only implementation I would support is one where the asking website doesn’t know your ID, and the verifying website doesn’t know what you’re trying to visit. Essentially just asking for a one-time use token that verified your age, and providing that token to the website you’re trying to visit.
Edit for a bit more detail: User authenticates to verifying website, which provides them a token with age verification (true/false) and a short (10 minute?) TTL. This token is encrypted by the verifying website. User then provides this token to the asking website (eg: pornhub). Pornhub then sends the token back to the verifying website to decrypt it. All pornhub knows about you is whether or not you’re of age, and the verifying website never knows what the token is for.
The only implementation I would support is one where the asking website doesn’t know your ID, and the verifying website doesn’t know what you’re trying to visit. Essentially just asking for a one-time use token that verified your age, and providing that token to the website you’re trying to visit.
Edit for a bit more detail: User authenticates to verifying website, which provides them a token with age verification (true/false) and a short (10 minute?) TTL. This token is encrypted by the verifying website. User then provides this token to the asking website (eg: pornhub). Pornhub then sends the token back to the verifying website to decrypt it. All pornhub knows about you is whether or not you’re of age, and the verifying website never knows what the token is for.