Age verification, digital ID, and data retention are sold as cybersecurity wins. A technical look at who gets monitored, and who simply routes around the rules.