

-
You connect to an age-gated site.
-
Your browser receives an age verification request that does not contain information about the site.
It would contain the time, a random number, and the query: Is user over 18/16/14/whatever?
- Your browser sends the request to a government-licensed service.
You identify yourself to that service in some way. The service could also be a program on your own device that uses a chip on your ID-card. If the service confirms the age, it digitally signs the request.
- Your browser returns the signed request to the age-gated site.
The site checks if the signature is valid and done. There’s never any connection between the age verification service and the site. If the request is more than a few seconds old, then it will be rejected to prevent sharing.
Of course, this assumes that sites will cooperate and implement such schemes at their own expense. Obviously(?) that will only be done by the larger sites, so it will be quite pointless. I don’t know why that is not a consideration. Understanding that doesn’t actually require any deep technical knowledge. But that’s typical for EU tech regulation.
The high volume of requests would be detected pretty quickly. The verification service would not know what sites you visit, but it would know that you are making requests.
To succeed, that would need a fairly large number of stolen or fake identities. There’s really no point when you can just sell adult products, including pirated media, directly.