And for the really bad news? They've put a target on VPNs. Sites are required to identify (and age-verify) any US citizen, regardless of whether they're using a VPN.
In fact, the default is to get the ID and biometrics of EVERYONE unless you can somehow prove their not a US citizen.