Doesn’t this create a “hackers’ charter” by creating lists of an individual’s browsing history?

No – age verification would be carried out by independent providers who would not need to retain any personal data including any identification once they’d issued an age check