There a significant difference between "the user can be identified fairly well if you can get access to sensitive stuff" and "the owner is always explicitly recorded in a searchable database".
Where in Europe should that be? I live in Germany and for example Stuttgart has a shortage of nurses because they can't afford living in a 1 hour commuting range (one way).
No, they don't have to (this is a common myth and FUD). That data can remain encrypted and private. For example, the token could be signed with the private key from person and TTP. They do know when people visit a website (or other entity requiring auth) but anyone with network access does.
All the platform gets to know a person 18+ is visiting their platform. In their data analysis, they could add such information to the rest of their data analysis such as IP, but this wouldn't be within scope (illegal in EU). Just worth it to mention in case a platform gets compromised.
So:
Username Bob, age 18+ (verified), from IPv4 1.2.3.4, visited PronHub, at 2 AM, with browser XYZ.
vs
Username Bob, from IPv4 1.2.3.4, visited PronHub, at 2 AM, with browser XYZ.
If Bob isn't logged in, they have to auth every time they visit.
And this is going to happen due to nefarious actors. LLMs (AI), as well as state actors in countries behind the other fence of Iron Curtsin in the New Cold War.
How can the third party not know I visited pronhub when pronhub verifies a token with the third party handed to me by the third party?
This may protect my privacy towards pronhub if I am not logged in. But not my privacy against the third party where I need to be logged in and who likely knows my real identity.
I thought about getting a SIM when Germany was about to introduce ID requirements. I quickly realized this being a moot point.
reply