I wasn't thinking in detail, just addressing an assumption I think a lot of age verification discussions include, which is that the verifier would have to be trusted to maintain some sort of account for you, retaining your data etc.

I have no idea what the legislation says, but I'd be a happier privacy-conscious user if the verification platforms were independent (i.e. not in any other data business) and regulated, with a requirement they don't retain my personal data at all (like the liquor store example)

So the verifier gathers data from you, matches it with a request from the platform, provides confirmation that some standard has been met, and deletes almost all personal information - I acknowledge that this may not rise to the double-blind standard of the original request

Edited to add:

• you don't have to 'buy' a token, the platform needs to pay verifiers as a cost of business

• some other comments are asking how you prevent the verifier knowing the platform - to my mind you don't, instead the verifier retains a request id record from the platform, but forgets entirely who you are