how to solve it the age without leaking data to third party servers?

Really easily. There are multiple possible options, not all equally easy, but the best option for privacy is also the easiest.

You don’t do true age verification. You mandate that operating systems and browsers work out a parental controls API and require apps and websites support that API. Then you ask (if you really want, you could demand, but I’d prefer to ask or suggest) parents to ensure their kids’ devices are configured correctly. When a user tries to access an age-restricted site, it calls an API in their browser, which calls an API in the OS, which returns a simple true/false value based on whether or not the current profile is configured to be old enough to access it.

Adults don’t have to do anything to prove they are adults. Merely the fact that they were able to buy a device that they control and didn’t get configured as a child is the proof.

More complicated solutions if you really insist on having true age verification could involve blinded signatures. I can explain in more detail if people are interested, but the slightly simplified TL;DR is that you have a system where the user goes to a trusted age verifier (my preference is for governments to do this themselves rather than farm it out to private companies, but either works). They do the age verification using ID, face recognition, whatever, and send the user a special token that they can use to prove they were age verified but which the site can’t use to determine any personal details about the user. Meanwhile the age verifier doesn’t know what site the age verification was just done for.