The legislation is clear and unambiguous : an operating system must provide an age verification which is able to accessible by third parties on the internet.
From a non-lawyer perspective, it is not yet clear how such regulations apply to a non-commercial, volunteer-driven project like Debian, which does not sell software and provides it in a highly decentralized way
There's no mention of selling in the law.