It doesn't have to work like this.

It's technically possible to do verification such that the authority (probably the government which already has a database with your age), doesn't get any communication when verification takes place. They'd have no idea which sites you visit or join, or how often.

And the site which receives the verification token doesn't learn anything about you other than your age is enough. They don't even learn your age or birthday. They couldn't tell the government about you even if subpoenaed.

(But if you tell them on your birthday that you are now old enough, having been unable to the day before, they'll be able to guess of course so it's not perfect in that way.)

Using modern cryptography, you don't send the authority-issued ID to anyone, as that would reveal too much. Instead, on your own device you generate unique, encrypted proofs that say you possess an ID meeting the age requirement. You generate these as often as you like for different sites, and they cannot be correlated among sites. These are called zero-knowledge proofs.

They work for other things than age too. For example, to show you are an approved investor, or have had specific healthcare or chemical safety training, or possess a certain amount of credit without revealing how much, or are citizen with voting rights, or are a shareholder with voting rights, without revealing anything else about who you are.