A particularly sensitive topic is the use of biometrics, such as facial images or voiceprints, to estimate the age of a user. The first thing to say is that such methods never require the retention of this sensitive personal data. The software does not need to use the actual facial image, but rather, it measures certain features and patterns of an image, and it is only those statistics that are then assessed by algorithms to look for similarities with the patterns found from people whose age is already known (this is called a training data set). The key point is that the data required to estimate age cannot be used to reconstruct a facial image. And even then, it is not retained for more than the seconds it takes for the software to provide an age estimate.
In many ways, this approach is better for privacy because an AV provider never needs to access any personally identifiable information other than the temporary use of the biometric patterns. So, the age verification provider need never know your name, address or actual date of birth. They can quickly estimate your age and then simply confirm to a website if you are old enough (or in some cases, young enough) to access the site.
Even where the user creates an account so they can access other websites in future without repeating the estimation process, there is no need for the AV provider to retain the biometric data – the user could create a username and password, for example. It may be convenient to use a separate process, facial recognition, instead of a password, but this is quite different and users would always need to consent to this. It also has its own safeguards in place to prevent abuse (see here).