They’re required to verify that users are above a certain age. There are no requirements to solicit and keep information or documents beyond that. Just because the easiest shortcut to age verification is requiring a copy of a government ID, this doesn’t mean that that’s a good idea.