I think structuring the law as a penalty is "smart" in that the government does not have to explicitly ask providers to require ID, but I can't imagine them not

I think structuring the law as a penalty is "smart" in that the government does not have to explicitly ask providers to require ID, but I can't imagine them not being at significant financial risk without doing so. This will make the providers look like the "bad guy" to an end-user.