Very straightforward with existing primitives. Use Login.gov to attest about age range to consuming service as Apple does today. I don’t think there is will to implement this at Login.gov at the moment though.

If you have a Social Security or CBP account for TSA Precheck or Global Entry, you have this account today. IRS will eventually adopt when stronger remote identity proofing requirements have been met, replacing id.me. Important context because it means it’ll cover everyone 18+ in the US eventually.

https://www.login.gov/what-is-login/

https://support.apple.com/en-us/125662

(Login.gov also supports state use cases as of 2024)

There is no way this would be "the best" or even a good thing at all, any time before we have the US equivalent of the GDPR that keeps every company from simply demanding full ID, laws prohibiting the sale of locked down computing devices where privileged keys are installed by the manufacturer (ie ban remote attestation that's capable computational disenfranchisement), and a culture of respecting privacy so that such requirements would be unthinkable to apply to Internet connections, P2P communications, and the like.

As things stand, the only sensible way to keep kids off of social media, porn, etc is client side filtering and controls. It would be straightforward to write legislation that requires device manufacturers to make parental control settings available in the setup stage, and require websites over a certain number of users to publish content labels asserting suitability for people under 18, 13, etc. Every other approach is a backdoor mandate for identity verification, dishonestly cloaked as "age verification" for "protecting the children". And I say this as a parent who will be staring down the digital heroin industry in a few short years.