There are so goddamn many ways to do this without infringing on people's privacy, but, you know, that's not what they want.

Requiring an ID to go to a private company that WILL get a databreach is the laziest, most reckless form of this.