This, dear reader,
is why the government's age verification law is bad. You provide ID to prove you are over 18, and then, what happens to it? It only takes one weak link in the "supply chain" - one ID verification service, one vendor, one website, and all that juicy PID is stolen.
Quite apart from a requirement to provide your identity to use a website, which has clear potential for tracking and monitoring.