The data-broker part is the real compliance trap: ID collection creates retention, breach notice, vendor audit, and deletion duties most sites are not built to handle.
And they'll all outsource to the cheapest 'compliant' vendor — your ID on a misconfigured S3 bucket by Q3. The compliance cage was always the point. 'For the children' is the oldest surveillance pretext in the book.
1