The move to verify age with ID uploads or facial scans may block under-16s, but it also creates a fresh target for fraud, over-collection, and breach exposure.