The ESRB has added:

“To be perfectly clear: Any images and data used for this process are never stored, used for AI training, used for marketing, or shared with anyone; the only piece of information that is communicated to the company requesting VPC is a “Yes” or “No” determination as to whether the person is over the age of 25.”

Sure, ok...

I don't know what else to say about this, this will obviously turn into something else.