How not to mandate device-based age assurance