I mean, laws that regulate data privacy for companies like this could probably help too. I dont think its reasonable to allow storing data from scanned legal ids without explicit, written consent from the ID holder to start.

Unless there is an aggressive public education campaign, most people will likely be ignorant as to the purpose of the card scanning and the privacy risks.

Consumer boycotts are very often ineffective and shouldn't be relied on. This may distress libertarians, but regulation is the only real answer.