> but how do you enforce that kids connection always goes through the parents control?

Because the devices they're given by their parents should be administered by their parents. The minors wouldn't have administrative control over their devices at all.

> You want to use your friends Wi-Fi? Now that requires full identification so that we know that its not some kid

The device wouldn't care how the connection to the internet is made. It ultimately obeys the parents' settings.

The Wi-Fi doesn't need to care either way.

> You are just moving the verification point to another gate, it means that no anonymous connections are possible anymore to the entire Internet because we want to allow parents to control their kids.

Not at all. This wouldn't affect people without parental controls on their device at all. They'd be able to have anonymous connections as they do now.

The only difference from the server-side is adding some special path /.well-known/parental-info.json or an HTTP header to responses that would indicate what's on the page from a parental perspective, so the device can make a decision whether to display based on its parental settings.