I think the problem is basically that it presents some (albeit weak and messy) solutions for companies and they're not stopped by law from this risky behavior.

I think the problem is basically that it presents some (albeit weak and messy) solutions for companies and they're not stopped by law from this risky behavior. Since national IDs are politically untenable in the US no pkey alternative is forthcoming - at least none that appeal to lazy companies who want aa low effort solution. We are long overdue for some federal legislation about how ssn can be used and how it cannot along with other basics to protect people from I'd theft. It should be illegal to use it as any kind of identity verification for instance, but its not.