Right now the system is still just theoretical so the specifics are undefined. But the idea is that they wouldn't. I assume they could still figure it out by tracking the IP addresses of those who access the token and matching it to a company. But the company doesn't have to send a request. I assume you are just generating a link that says "This person is age X". So the link itself serves as the verification. The link would only be valid for 5-15 minutes, so you can't just steal it to impersonate someone else.