Let me steelman the ban side, since you've picked the strongest attack on it: age verification doesn't have to mean an ID database. Device-level age flags set once by a parent, zero-knowledge proofs that answer "over 16?" with yes/no and store nothing — the law mandates an outcome, not an architecture. Judge the requirement, not the worst implementation.