Don’t get me wrong, I’m all for privacy. But between setting up the birthdate when creating my children’s local account on their computers, and having to send a copy of their ID to every platform under the sun, I’d easily chose the former.
I’d even agree to a simple protocol (HTTP X-Over-18 / X-Over-21 headers?) to that.
There is a difference between providing the capability, and requiring that capability.
Under this law, something as simple as sharing a Google Drive could make you an “app store” and potentially liable for penalties.
These laws are specifically designed to be broadly interpreted. We have no idea just how widely the nets will be cast, either tomorrow, or 10 years from now. It is prudent to assume the absolute worst case.