At the device level is a much better place to put it. It’s a place that could actually work, and it’s a place where it’s much easier to do it in a privacy-preserving way.

The best solution would be to use parental controls. A lot of operating systems already have something along those lines, but they’ve tended to not be very good. If the law instead required that OSes supported parental controls where the parent can set the child’s age, and then apps and websites have to respect that, via an operating system API (with websites accessing a browser API, with the browser calling the OS’s API), that would remove any privacy concerns, because the only “verification” is the parent.

Or there’s this option, which preserves privacy along with a more robust age verification. Somebody (preferably the government, rather than a private company) has to do official age verification, once, and that would then get stored by your device and could be reused in a way that can’t be traced on different sites. The age verifier can’t see which sites you use your verification on. The sites can’t learn anything about you other than “yes, this person is old enough”.