As many people have noted, a different system could delegate the enforcement to parents. Instead of forcing a web site (or an OS!) to collect identifying information and certify the age, we could demand that a web site would send a header stating the legal age boundary. The user's device then would be demanded to honor it, depending on device's settings. Parental controls should work, and parental controls are already there on most devices. Open-source software would have no trouble implementing parental controls, because they leave the responsibility and the choice with the user. No identity info would leak to third parties.

In a more elaborate case, a state identity provider (something that provides birth certificates, passports, etc) would provide an OAuth-like flow that would certify the age of a bearer of a short-lived token to a site which generated the token, without giving any details. This gives the parties more assurance, and gives the state a bit more visibility, but still mostly preserves the user's privacy.

I don't think that these simple ideas never came to the lawmakers' minds, or to their tech experts' minds. But it's less appealing to them, because it results in less control. Why not push for more disclosure when a chance presents itself?

For thirty years now, preteens, whether alone or huddled with peers, have peered at computer screens and sought these things on the World Wide Web. In the 1990s, it was porno tapes the cool kid sneaked from her parents' closet and brought to the slumber party. In the 1980s, it was sticky magazines stolen from the newsstand or an older brother's closet. The technologies that made these things possible is part of the real world.

I can't even buy a sandwich in the "real world" without a computer's involvement in the transaction.