The bills I've seen in the US indicate that you need to use a commercially acceptable solution (so don't mandate government), and include regulations for private providers to follow (e.g. that age validators are also barred from retaining information about the validation).

Sadly, most companies aren't competent enough to delete data and the government isn't competent to verify whether they delete data or not.