[brookst]

Look at Apple’s PAT: the website knows the service that did the attestation, but not the user. The service knows the user, but not the website. If you controlled both you can link the user, but otherwise you can’t.

[palata]

Yes, but they can still collude. It's possible to do age verification in a way that prevents that. Look e.g. at Privacy Pass.

[brookst]

PAT is Privacy Pass.

[palata]

Oh right, my bad. And how can they collude there?