Re verification per AP,

The amendments passed on Friday bolster privacy protections. Platforms would not be allowed to compel users to provide government-issued identity documents including passports or driver’s licenses, nor could they demand digital identification through a government system.

So it sounds like an ID will not be a requirement.

I suppose a face scan is possible, but I find it unlikely. Obviously if it heads in that direction then the law should be amended to clarify that is also not acceptable.

In terms of selling information I assume that just clarifies the status quo and isn't new. Not that that makes it acceptable, it just means that's something to tackle.