Can't read the specs at the moment, but what prevents the age verification service and the age-gated website from coluding and de-anonymizing your porn use?

With zero-knowledge-proofs the age verification could look like this: you go to whatever age verification service and get a certificate that says you're over the age of 18 (which you only need to do once or at least once per whatever expiry period). You then go to the age-gated website and they ask for proof. You generate (on your own device) a zero-knowledge proof that you have the certificate, but neither the website nor the verification service can determine which certificate it is, and in fact the verification service doesn't even know you've used the certificate.

Haven't either had time to fully wrap my head around the details.

At least in the EU solution they say there would be multiple attestation serivices the user could choose to use. So that would be technically better than nothing.