This approach is just fine for the industry: delegate the problem to the lowest, shadiest bidder. After all, privacy breaches aren't their problem. If governments want an ID system they should provide one.
We have gone from the industry clamouring that what's being done now is not possible and spending millions of lobbying money against it, to such laws spreading like wildfire.
The next step is the (inevitable) mess up because implementations won't be foolproof, followed by yet more millions of lobbying money being spent to amplify the effect of these mess ups.
Eventually we will come to a new normal. It will take time. But the hope is that the cat is out of the bag and we don't come back to a model that we know hurts children and pretend it's just how it is.
