Additionally, the law makes no judgement on the technology used to identify age, just that social media companies need to make an effort. I suspect that companies will not want to deal with the data security issues (very illegal to share pictures of underage people without consent), and will not be "sharing" with 3rd parties.
Pretty much every company will contract a 3rd party service to perform those checks, making sure they get as much bang for as little buck as possible. Said services are usually the weak link that shares the data with others, often through PNGs in public buckets so that Russian teenagers have an easy job CURLing them.
If the government took security seriously, it’d endorse a solution and then take responsibility for it, given it came up with the law in the first place.
Given how invested you are in the Apple ecosystem I can’t fathom why you would go get an Apple Gift Card from a store to do this kind of transaction, though. It wouldn’t even cross my mind to do it that way.
Obviously I'm not claiming it was OP's mistake, that wouldn't make me any better than the guy who was telling people "you're holding it wrong™".