That’s an interesting question.

Actually, a follow up. PII leaks are so common, I guess there must be millions of identities out there up for grabs. This makes me wonder: we’ve got various jurisdictions where sites are legally required to verify the age of users. And everybody (including the people running these sites) knows that tons of identities are out there on the internet waiting to be used.

How does a site do due diligence in this context? I guess just asking for a scan of somebody’s easily fabricated ID shouldn’t be sufficient legal cover…

These ID laws typically require a solution to be "commercially practical" or similar. The standard is not "impenetrable and impossible to circumvent"

That's why some of them don't even ask for ID but just guess the age based on appearance. That's good enough per the law, usually.