I read, from a semi-reliable source, Lousiana has pretty good system for verifying age and protecting ID. But's focused on in-person ID for gambling.

The system was that they hired a company to make the cards, and assume civil liability for any privacy violations. They also required to the company to hold insurance in case of a claim.

So it fell to the insurance company to sign off on the standards, and allowed investors to make money by avoiding claims.

I might be half-remembering it but that seemed like a very good system.