Where are we talking about installing malware? This could be implemented by the os itself, like many other similar things in the last years as well (password storage, covid nearby activity, …). The os could just ask the user to verify his age by identity card or similar, would then store a flag after verification and a browser -> website can access this.

The only problem I see with this, if there is no verification on the other side, you could “just” have a browser which tells the website that the user is adult, no matter what, or, if it’s more dedicated, could even use a modified version of Linux to always have the flag set, haha.