That's easily done with a unique identifier associated with the transaction.
There may be a unique transaction identifier, but what would Veratad be able to produce for an audit trail that establishes who they checked and how they checked it? Otherwise, it's the vendor pointing to Veratad as "they said it was good" and Veratad pointing to the vendor "well, there's the unique identifier we issued, they know who the customer is and have that information".
Pretty much the same basis as you get a prescription filled, your name, address, DOB,
insurance ID, and so on and so on is scanned/entered into a database to establish who got what medication, and who authorized it. Someone needs to keep a record of your DOB and a reference to how and where it was verified. Otherwise, there is no method to document that a proper identification was made, making the whole "verification" process useless.
Obviously, this is an online problem, as a B&M
shop merely has to ask for an ID of someone under 27, but not keep it on file. They will, however, be subjected to random "stings" to assure compliance just like cigarette sales and even
vape sales in many states. But online, there's no way to know who logged onto your site and ordered something, and if it were my business on the line, I sure would like to be able to show how I verified a customer (not just pointing at Verartad, but literally be able to produce a DOB and a reference to what original source was checked for verification). It's also a lot easier for the FDA to run sham purchases through a bunch of vendors with underage information with a fake DOB using just a credit or debit card and seeing if they are stopped from completing the transaction, than to physically send actual "young people" around to thousands of B&M vendors.