If a service claims GrapheneOS users are reportable for “past security concerns,” it suggests their verification logic relies on static device attributes or behavioral baselines that this OS explicitly removes. This highlights a fundamental incompatibility where privacy-hardened environments cannot meet the opaque, risk-based demands of many age-verification schemes without sacrificing their core security guarantees.