The way EU is planning on implementing it is seemingly rather okay on the privacy side.
Basic idea is that instead of sending your actual ID to every random shady website, which is fucking stupid and you should never ever do, you verify your ID once to a trusted processor, and the websites only receive a simple "Is adult: yes/no" answer connected to a randomised ID from them.
Combine that with one additional hop between the website and processor and you eliminate the processor even knowing what websites you requested the check for, and therefore the risk of a data leak is minimal.