They can require a selfie to compare against, multiple documents, a video, etc. IMHO best bet is to consolidate the validation to a small set of reputable companies, delegate validation to them, then improve regulations around access. Eg non-reputable site needs to know you are 18 (etc) but not see your actual id if they can have a third party do it in a blind-to-them fashion.