There is no acceptable amount of PII a business should hold unless required to by the government for extremely limited industries (ie, banking or medicine or the act of employment).
Every single government that is requiring age verification is not also legally indemnifying companies that are performing this. Every single company that is trying to provide this will be hung out to dry when this blows up in their face: the company will be heavily fined under the existing laws in that country.
In many countries, banks that have to follow KYC or similar laws or hospitals that have to follow HIPPA or similar laws are given at least some form of partial legal indemnification as long as they can prove they were following the law. This is why they almost uniquely keep getting away with it with a slap on the wrist when they inevitably fuck up.
This will never be offered to companies like yours. You are taking on, essentially, infinite legal risk to make a quick buck.
If your legal council is telling you they can defend you from this, I suggest finding new legal council. IANAL, IANYL, but proceed very carefully. This is not a technological problem, this is a legal problem, and you cannot solve this with technology.