It’s a case of mutually assured destruction: to charge someone with impersonation, they would have to admit that they saved data that was supposed to be only for age verification and then deleted.