The solution is really, stunningly simple:

Your gov issues official documents about you (driving license, passport, id cards...). They know your age.

Your gov is also a trustworthy institution since all those cited above are official documents that anyone, anywhere will accept as valid.

So here's the solution: the gov creates a digital certificate in which the only stored data is your age, or even less: your adult state (as a boolean; if over 18 = TRUE).

The gov issues the cert on demand to any person after presenting any valid ID to prove who you are (it can be done online, with only the id verification being done in person). The cert is bound to your device, and if you change phone, you must migrate it so you can't have it in two devices.

Since the issuer is a trusted authority, the cert can be used as a proof of age in any site needing it as the only thing they need is to read the cert and confirm the auth of the issuer.

And as the cert is only a boolean status saying if you are underage or adult, there is no privacy concerns as the one checking your age won't know anything else about you.

There, you just solved a "huge" problem in a simple way and with no privacy concerns.

As someone who comes from IT, what are you talking about?

You rightfully assert that facial recognition and government ID are privacy invasive, but then you offer DNA verification as a less invasive tool? That's much more privacy invasive.

Also, it's impossible to determine someone's age from some DNA with the required accuracy. The law requires that 18+ content is available to someone who just turned 18 today and not available to someone who's 18th birthday is tomorrow. That's impossible to do from DNA, same as it's impossible to do from just facial recognition alone.

Carbon dating only works for dead materials since e.g. your skin or your skin is only ever roughly a month old and even blood cells only live for ~120 days. Also, again, carbon dating is not nearly accurate enough for the day-accuracy required.

The only day-accurate process that exists is verifying your identity against government ID. And here it hardly matters which kind of ID is used for that (facial ID/DNA/Fingerprint/...) since the issue at hand is the ID itself. Facial ID is by far the least privacy sensitive version of biometric DNA.

This process isn't great, no question about that, but the alternatives are worse if hard age verification is the goal.

That's why the whole goal is being called into question, since there's no non-privacy-invasive option to do real age verification.