The two attempts to set a legal standard for this (COPA and OAVSCA (Son of COPA)) have, in the former case, been repeatedly trounced in court (to the point of being ruled unconstitutional), and in the latter case, never even made it into law in the first place. As it stands there is no real law that enforces online age verification.
There is no reasonable way to get a persons age over the internet other than by asking them, so you're going to have to ask them. There is just no way around it. This is why COPA failed: it placed an obscene and insurmountable burden on website maintainers.
Even if you asked a person to physically show up at your offices with proof of age, and verified all their information before you gave them their login, there is still no way to know that the person who logged in is the person who showed up. You'd need some kind of biometric system coupled with a camera to make sure the original person didn't leave the terminal at any time. I've used classified government systems that didn't have that level of security.
In the end, you're going to be forced to go with self-reported data, and you're absolutely going to have people who are misrepresenting their age for the purpose of agreeing to your ToS.