the law forbids requiring id for verification
So they verify by other means, eg facial recognition. The government has your ID already, so they're getting access to this additional personal information via private third parties.
and forbids anything collected for verification purposes from being used for any other purpose.
Forbidding something is almost meaningless when you cannot monitor and enforce it. There is virtually no way to prove they aren't selling data under the table.