Not sure that's necessarily true. I don't see why it couldn't work like this:
- request personal token from authority. it works similar to a certificate chain, your token is derived from a central certificate
- you store your token locally
- you visit an age-restricted website. you send your token (or a challenge encrypted with that token) back to the website
- the website verifies your token with the certificate from the authority, (like how literal Certificate Authorities work) . the CA doesn't know when or why your token was used.
(fwiw I am sure governments will try their best to make this process less private)