Ideally, we wouldn’t need to do age verification at all. But if it’s absolutely required, the most privacy-preserving way would be:

1. System administrator verifies the birthdate of the user, stores it on the user account
2. Applications can then ask, “is the current user over 18?” And just gets true/false.