They are making noises about requiring more than just the user's word for it. Validating a credit card number or driver's license is the typical thing. And we also have to worry about GDPR, and the new California privacy law that takes effect next month, etc. This stuff is so not how I want to spend my time!
P.S. Just so I'm not misunderstood: I'm a big believer in privacy. I just wish they could write the laws in a way that doesn't pose insuperable obstacles to nonprofits with no money to pay specialist privacy lawyers. My proposal is the No Repurposing Law, which would say that if I give you some information for a certain purpose, and you use it for some other purpose, you get both hands chopped off. No opt in, no opt out. Very simple, no lawyers needed. ("You" = the officers and directors, if a corporation.) (Trivia fact: Google abandoned "Don't be evil" as a corporate slogan right when they discovered the idea of targeted advertising.)