> The requirement is to do something to estimate the age of users, nowhere does it say that would always need to be more invasive than asking the user if they'r

> The requirement is to do something to estimate the age of users, nowhere does it say that would always need to be more invasive than asking the user if they're over 18. No, it doesn't say that it would always need to be more invasive than that. I doubt a prompt asking the age would generally be seen as "Estimate the age of child users with a reasonable level of certainty..." Having to deal with invasive means of validating your age is a reasonably anticipatable consequence of this law. And it shouldn't be a big surprise that the data ends up misused, even if the law makes a token (very weak) effort to prohibit that.