They are not verified. They throw a penalty for lying in ($2,500 per "accidental" violation and $7,500 per intentional), and there is a provision for allowing vendors to ignore the token if someone is obviously lying about age, but the actual token is never verified and there are no provisions to do so.
The primary goal of CA's bill isn't to stop underage kids from accessing content for adults. That's what it looks like on the surface, but the *actual* goals are:
1. Eliminate liability and complexity from marketplaces so storefronts don't have to worry about age verification, and
2. Prevent data scrapers from using "age verification" as a backdoor into making giant databases of real identities and mapping them to digital ones.
The former is covered expressly by a liability limitation to stores and other users that make a good faith effort to validate and use the tokens, and the latter is covered by a clause that says "no other form of age verification may be required by application developers beyond the checking of this token," which shoots companies like Persona directly in the face.