To keep under 16s out, everyone over 16 needs to prove they are indeed over 16. It's like a nightclub/pub/bar - to get in, EVERYONE needs to prove their age, either with a real or fake ID.
IDs don't need to be collected and stored, but "reasonable steps" could mean that Meta, for example, may use services to verify a Driver's License or Passport number, or obtain a myID token that proves age.
How else do you keep kids out for their own safety?