I’ll probably use a different DoB for each but keep it in a password file and treat it like a password of sorts.

The data controller was actually being quite responsible in this case by verifying a simple piece of info that should have been mutually known. Many data controllers are reckless and demand a full copy of an ID card (entirely against GDPR rules).

Now you've run into the same issue as using your real DOB.

I usually do 01-01-1970 because its easy to remember and isn't my real DOB but I was born in the 1970's

Of all the things that remember it, Steam is the only one that knows the truth but somehow remembers the fake date I gave it once when asking for age verification before letting me look at an adult rated game. Always makes me chuckled that they allow the lie to continue.

What data controller is that?

Grocery store loyalty card. I actually quit all grocer loyalty cards because the 1% savings or whatever is a lousy insignificant amount for being tracked in such detail. And I switched to cash. The grocer’s website started blocking Tor so I started boycotting them and I’m just digging around on the principle that if they don’t have enough privacy respect to serve Tor users then they should be probed.

The whole point of the loyalty card is to do market research. They would likely claim that processing birth date is lawful under Art.6¶1(b) (“processing is necessary for the performance of a contract”). But is it? I mean, buying the food doesn’t even need a contract. One could argue that offering exclusive promos to cardholders does not require any data collection. But it would defeat the grocer’s purpose for entering into the contract. I guess I should read up on EDPB guidelines 2019/02.. that should have the answer.