While I don't discount the possibility of a service screwing this up (I've been in the industry long enough to know that they will), the bill at least tries to address this by requiring that there be zero retention of age-identifying PII once the age has been verified.

That can be addressed by using a three party age verification system, where the three parties are the social media site that wants to know you are above the age limit, the site that you provide proof of your identity and age to, and you.

With a properly designed protocol you can do this in such a way that (1) the social media site gets no information about you other than that you are old enough, and (2) the site your prove your identity and age to only gets whatever documents you provide and does not learn which social media site the proof is for.

That covers data breaches at the social media sites. They never see the PII for age verification.

The way to deal with the possibility of a breach at the site that does see your documents is to use a site that already have copies of those documents, such as a government agency or maybe a bank.

give it 3-5 years, tops. probably not a big player directly, but a 2nd line aggregator or value-add company.

Or leaked it without storing it.