No, there are fairly well established technologies to do this without giving the third-party any information about which site is asking for authentication. The

No, there are fairly well established technologies to do this without giving the third-party any information about which site is asking for authentication. The most famous that comes first to mind is the Kerberos protocol. An simplified example could be that I ask the third-party to sign a package that include my current IP address, a message that say "I am over 18", and a validity period. They sign it (after I identify myself to the third-party), and give me the requested signature. I then give this to the website and the website can verify the signature of the third-party. The website only know my IP address, the time, and what third-party service I use to verify my age. Third-party only know my ip address, the time, and that I requested a token for "I am over 18". A major drawback occur if this is only used for porn. In that case, the message "I am over 18" will be synonymous with porn use and thus giving the third-party information that they should not have.